{
 "id": "AIR-2025-0065",
 "slug": "rules-file-backdoor-supply-chain-attack-on-ai-coding-assista",
 "title": "Rules File Backdoor: Supply Chain Attack on AI Coding Assistants",
 "summary": "Researchers demonstrated a supply chain attack where malicious instructions hidden in rules files using Unicode characters manipulated AI coding assistants. The attack tricked tools like Cursor and GitHub Copilot into generating vulnerable code.",
 "type": "attack_on_ai",
 "categories": [
  "supply_chain",
  "ai_generated_malware"
 ],
 "severity": 1,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Cursor",
  "GitHub Copilot"
 ],
 "incident_date": "2025-03-18",
 "incident_date_precision": "day",
 "first_reported": "2025-11-07",
 "sources": [
  {
   "url": "https://atlas.mitre.org/studies/AML.CS0041",
   "publisher": "MITRE ATLAS",
   "title": "Rules File Backdoor: Supply Chain Attack on AI Coding Assistants",
   "published_at": "2025-11-07"
  },
  {
   "url": "https://pillar.security/blog/new-vulnerability-in-github-copilot-and-cursor-how-hackers-can-weaponize-code-agents",
   "publisher": "Pillar Security",
   "title": "New Vulnerability in GitHub Copilot and Cursor: How Hackers Can Weaponize Code Agents",
   "published_at": "2025-11-07"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_atlas",
 "tags": [
  "supply-chain",
  "coding-assistant",
  "unicode",
  "backdoor"
 ],
 "created_at": "2026-10-18T06:55:08.239Z",
 "updated_at": "2026-10-18T06:55:08.239Z"
}