“Once a compromised rule file enters a project repository, it corrupts all future code-generation sessions for every team member working in that project.”
Invisible Unicode in an AI rules file can make Copilot and Cursor quietly write malicious code for everyone on a project. GitHub’s review screen does not show the characters. Cursor said it is the user’s responsibility. GitHub said the same and added a warning weeks later.