New Vulnerability in GitHub Copilot and Cursor: How Hackers Can Weaponize Code Agents Through Compromised Rule Files

Quick Summary:

The discovery of the Invisible 'Rules File Backdoor' exposes severe supply chain risks for millions of developers relying on AI-assisted coding tools, potentially compromising software ecosystems worldwideTEL AVIV, Israel, March 18, 2025 (GLOBE NEWSWIRE) -- Pillar Security, a pioneering company in AI security, discovered a significant vulnerability affecting GitHub Copilot and Cursor - the world's leading AI-powered code editors.

"This new attack vector demonstrates that rule files can instruct AI assistants to subtly modify generated code in ways that introduce security vulnerabilities while appearing completely legitimate to developers," said Ziv Karliner, CTO & Co-Founder of Pillar Security.

This newly discovered attack vector exploits hidden configuration mechanisms within these tools, enabling attackers to inject malicious code suggestions that blend seamlessly into legitimate AI-generated recommendations and bypass human scrutiny and conventional security checks.

Read Quick SummarySave Time

or

Article Details

Author / Journalist: Pillar Security

Category: Technology

Markets: ChinaIsraelMali

Topics: Pillar Github Legitimate Vector Files Developers Code Security Malicious Attack Rule

Source Website Secure: Yes (HTTPS)

News Sentiment: Negative

Fact Checked: Legitimate

Article Type: News Report

Published On: 2025-03-18 @ 14:40:00 (12 hours ago)

News Timezone: GMT +8:00

News Source URL: globenewswire.com

Language: English

Article Length: 435 words

Reading Time: 3 minutes read

Sentences: 17 lines

Sentence Length: 26 words per sentence (average)

Platforms: Desktop Web, Mobile Web, iOS App, Android App

Copyright Owner: © GlobeNewswire

News ID: 27151725

View Article Analysis

About GlobeNewswire

Main Topics: Technology

Official Website: globenewswire.com

Update Frequency: 111 posts per day

Year Established: 1998

Headquarters: China

News Last Updated: 8 hours ago

Coverage Areas: China

Ownership: Independent Company

Publication Timezone: GMT +8:00

Content Availability: Worldwide

News Language: English

RSS Feed: Available (XML)

API Access: Available (JSON, REST)

Website Security: Secure (HTTPS)

Publisher ID: #116

Publisher Details

Frequently Asked Questions