Hackers hide malicious rules in AI coding projects, hijacking coding assistants

Attackers hide prompt injection instructions in rule files in open-source repositories, hijacking coding assistants such as Cursor, GitHub Copilot, Anthropic's Claude Code and OpenAI Codex. Citing an announcement by the Cloud Security Alliance and research by Pillar Security, the article states that poisoned Markdown and workspace rule files achieved hijacking success rates of 40% to 84% in mainstream development environments. These instructions are encoded with Unicode Tag characters and zero-width joiners, appear blank in editors, yet are read by tokenizers and executed as trusted system guidance; IDEsaster disclosed more than 30 vulnerabilities in such agentic IDEs, and a malicious web worker in the EMBRACE audit could also bypass local directory read boundaries.