Every other AI-security capability in PullGuard defends the application you ship. This one defends the agent that reads your repository — attacks planted in a codebase to hijack Copilot, Claude Code, Cursor or Windsurf the moment a developer opens it.
A coding agent reads far more of your repository than a human reviewer does: instruction files, MCP server configuration, git hooks, and the comments inside source files. Anything it reads, it may act on. So a contributor who can land a pull request can attempt to instruct the reviewer's agent directly — and the payload never appears in the running application, which is where every conventional scanner is looking.
This is not theoretical. The class has named, measured instances: the Rules File Backdoor
(reported 41–84% success against mainstream agents), MCPoison
(CVE-2025-54136), booby-trapped git hooks (CVE-2026-26268), and
MCPTox tool-poisoning (~84% under auto-approval).
Detection covers the agent-consumed file set — the surfaces an agent loads without being asked — plus two content-gated source surfaces:
.cursorrules, .windsurfrules, .clinerules, .github/copilot-instructions.md, CLAUDE.md, .cursor/rules/*.mdc and the current Copilot and Claude Code formats..mcp.json, .cursor/mcp.json, .vscode/mcp.json, claude_desktop_config.json. Detected by content shape, not filename, so renaming the file does not bypass the rule..claude/hooks, committed .husky/ git hooks, .devcontainer lifecycle commands, .pre-commit-config.yaml.
These findings are not suppressed on test, fixture or
vendored paths, unlike most security findings. An agent reads
fixtures/ too, so a lure planted there is just as live.
| Finding | What it means |
|---|---|
| agent_instruction_injection | An instruction file tells the agent to do something outside the task — exfiltrate, fetch from an external host, or ignore prior instructions. |
| agent_instruction_hidden_unicode | Trojan-Source style hidden characters — bidirectional overrides or invisible code points — so the text a human reviews is not the text the agent reads. |
| agent_lethal_trifecta | One agent configuration combines private-data access, untrusted content, and an outbound channel — the three properties that turn a prompt injection into exfiltration. |
| agent_hook_suspicious | A committed hook runs something a hook has no business running — a piped download, a credential read. |
| agent_workspace_symlink_escape | A symlink points outside the workspace, so an agent told to stay inside the repository can be walked out of it. |
| agent_config_drift | An MCP tool definition changed after approval — the MCPoison rug-pull. Baselined by hash, so a committed baseline leaks no configuration. |
| agent_human_loop_disabled | Auto-approval is switched on, removing the confirmation step the other protections assume. |
| agent_unbounded_resources | An agent surface with no bound on what it may consume. |
These are security-category findings, so they are always surfaced and are not
hidden by the usual noise controls. Treat one the way you would treat a change to CI
configuration from an outside contributor: ask who added it, what it instructs the agent
to do, and whether the instruction belongs in the repository at all.
If a finding is a deliberate, reviewed choice, suppress it with a committed
.pullguardignore entry or the /pullguard ignore comment workflow,
both of which keep the decision and its reason in version control. See the
configuration reference.