SG-083: Cross-Agent Instruction File Poisoning

Severity: HIGH

AGENTS.md / .cursorrules / .windsurfrules / .continuerules / .clinerules / .goosehints with policy-override, persistence, credential-read, or silent-exfil directives. These files are auto-loaded by AI coding agents on every chat request without user review.

Fires when

• Only in an auto-loaded AI-agent instruction file (AGENTS.md, .cursorrules, .windsurfrules, .continuerules, .clinerules, .goosehints; CLAUDE.md / memory.md excluded).
• CRITICAL: a silence directive (`do not mention to the user`, `silently`, `secretly`) co-located (~within a paragraph) with a credential-file read or an outbound exfil call - the SANDWORM_MODE shape.
• HIGH: a policy-override directive (`ignore previous instructions`, `disregard your guidelines`, `override safety measures`).
• HIGH: a persistence directive (`always`, `permanently`, `for all future sessions`) co-located with a credential read / exfil action verb.

Remediation

Treat AGENTS.md and platform-specific rules files (.cursorrules, .windsurfrules, .continuerules, .clinerules, .goosehints) as trusted-execution context, not documentation. Review every line as if it were a shell script. Reject policy-override directives ('ignore previous instructions'), persistence directives ('always', 'remember across sessions'), silence directives ('do not mention to the user', 'silently'), and any reference to credential file paths (~/.ssh/, ~/.aws/, ~/.gitconfig, .env) inside these files. When sharing the repo, audit these files in the PR review; hidden Unicode characters can disguise malicious content (see SG-041).

Research

• https://www.pillar.security/blog/new-vulnerability-in-github-copilot-and-cursor-how-hackers-can-weaponize-code-agents
• https://blog.themenonlab.com/blog/agents-md-security-risk-ai-agents/
• https://prompt.security/blog/when-your-repo-starts-talking-agents-md-and-agent-goal-hijack-in-vs-code-chat
• https://www.startupdefense.io/mitre-atlas-case-studies/aml-cs0041-rules-file-backdoor-supply-chain-attack-on-ai-coding-assistants-fde7b