AI coding agents · Risk · CWE-1427 · OWASP LLM01

Your agent reads instructions you can't see

Some characters don't show up on screen. The text you read and the text the agent reads can differ.

Why it matters

Instruction files are read before every session. A line that looks harmless to you can carry text only the agent sees, and a rules file copied from somewhere else is the easiest place to hide it.

Where NeuroShield looks

FileWhat it reads
Instruction filesCLAUDE.md, CLAUDE.local.md, AGENTS.md and each agent's rules files.
Skills, subagents, commandsEvery file an agent loads as instructions.

How to fix it

Go to the line

Open the file NeuroShield names at the line it shows.

Retype or delete it

That line holds a character you cannot see.

Check the source

Check where the file came from before you use it again.

NeuroShield names the character and the line

It shows its code (U+…) and the line, so you can see what your editor hides.

Questions

Why don't I see it in my editor?

Those characters have no glyph, or they change how text is shown. The agent still reads them.

See your own agents

The check is free: how many agents you have and what they can do. Details and fixes come with Shields.