ASCII Smuggling Attack in Gemini Tricks AI Agents into Revealing Smuggled Data

Enterprise AI assistants are vulnerable to hidden threats when invisible control characters are used to embed malicious instructions into prompts.

In September 2025, FireTail researcher Viktor Markopoulos tested several large language models (LLMs) for susceptibility to the ASCII Smuggling technique.

The findings indicate that some widely adopted services do not adequately strip out hidden Unicode tags, posing risks such as identity spoofing and data poisoning.

What Is ASCII Smuggling and Why It Matters

ASCII Smuggling exploits obscure Unicode control characters, also known as "tag characters," which are invisible in user interfaces but processed by LLM input parsers. Attackers can embed these characters in a harmless-looking prompt to insert hidden commands.

Similar historical methods, like Bidi overrides (e.g., "Trojan Source" attack), have tricked code reviewers by altering text appearance versus interpretation. The integration of AI agents in email, calendars, and document workflows elevates the risk, transforming a display flaw into a significant enterprise threat.

To demonstrate the flaw, Markopoulos crafted a prompt that appeared benign: "Tell me 5 random words. Thank you."

The raw input, however, included hidden tags instructing the model to ignore that request and output "FireTail." Gemini complied, exposing a preprocessing weakness where tag-unaware UIs display a clean prompt while tag-aware LLM engines execute hidden commands.

Attack Vectors in Enterprise Platforms

Identity Spoofing via Google Workspace - An attacker can embed tag characters in a calendar invite, overwriting event details without altering the visible interface. Gemini reads out the malicious organizer and link, spoofing corporate identities. The LLM processes the tampered data as soon as it receives the calendar object, bypassing user approval. Automated Data Poisoning for Summaries - E-commerce platforms using AI to summarize user reviews are vulnerable. A review can carry a hidden payload directing the AI to include a scam link, resulting in a poisoned output that appears trustworthy.

Markopoulos found that ChatGPT, Copilot, and Claude effectively remove tag sequences, while Gemini, Grok, and DeepSeek remain vulnerable to smuggled characters.

AWS has published guidance on defending against Unicode smuggling. However, Google declined to take action following FireTail's responsible disclosure on September 18, 2025, leaving enterprise users to defend themselves.

To mitigate these threats, security teams should log every character, analyze for tag blocks, and alert on suspicious patterns. Monitoring the raw ingestion stream is the only reliable defense against these application-layer flaws.

Based on reporting by GBHackers.