GitHub Copilot custom instructions risk: a single malicious instruction line can induce the generation of backdoored code

The author tested and found that GitHub Copilot reads the .github/copilot-instructions.md file in the repository and adds it to the prompt context, so a single hidden line in the instructions file can make Copilot generate completions with backdoored code. The author demonstrated this in Go. The author also mentioned that Pillar Security previously pointed out that Cursor's .mdc rule files have a similar risk, involving hidden Unicode characters. GitHub mitigated the 0-click image rendering data leak last year, and clicking hyperlinks also shows a confirmation dialog, unless the target domain is in VS Code's trusted sites list.