Agent Instruction and Config File Poisoning

Evaluate

Explanation

Work out what a hostile repository could make each agent do. Two questions matter. Can project files run commands before a person agrees? Can the agent change its own approval settings without asking?

Test with the versions your team actually runs. The fixes above landed in specific releases, and old installs linger.

Insight

The dangerous files fall into two groups. Instruction files change what the model wants to do. Settings, hooks and MCP definitions change what it is allowed to do. The second group is where a repository turns into code execution.

Practical

• Check for hidden characters in every agent instruction file. This script exits non-zero if it finds any:

import subprocess, sys, unicodedata

NAMES = ("AGENTS.md", "CLAUDE.md", ".cursorrules", "copilot-instructions.md", ".mcp.json")
DIRS = (".claude/", ".cursor/", ".github/instructions/", ".github/prompts/", ".vscode/")

files = subprocess.run(["git", "ls-files"], capture_output=True, text=True, check=True).stdout.splitlines()
hits = 0
for path in files:
    if not (path.endswith(NAMES) or any(d in path for d in DIRS)):
        continue
    with open(path, encoding="utf-8", errors="replace") as f:
        for n, line in enumerate(f, 1):
            for ch in line:
                # Cf covers zero-width, BiDi controls and the Unicode Tags block
                if unicodedata.category(ch) == "Cf":
                    print(f"{path}:{n}: U+{ord(ch):04X} {unicodedata.name(ch, '?')}")
                    hits += 1
sys.exit(1 if hits else 0)

• Review settings files for pre-approvals: hooks, enableAllProjectMcpServers or enabledMcpjsonServers in .claude/settings.json, auto-approve keys in .vscode/settings.json, and tasks with "runOn": "folderOpen" in .vscode/tasks.json.
• Confirm each editor's workspace trust setting. Oasis Security found in September 2025 that Cursor shipped with Workspace Trust disabled, so folder-open tasks ran without a prompt.

Tools/Techniques

• The script above, run locally and in CI.
• GitHub's hidden Unicode warning in diffs and file views.
• Homoglyph and Trojan Source Attacks covers wider Unicode checks for source code.

Metrics/Signal

• Hidden-character findings in agent config files (the target is zero).
• Repositories whose project settings pre-approve commands, hooks or MCP servers.