ASCII Smuggling Attack Lets Hackers Manipulate Gemini to Deliver Smuggled Data to Users
Recent research has highlighted vulnerabilities in large language models (LLMs) when exposed to the ASCII Smuggling technique. This method employs invisible control characters within text to insert hidden instructions that bypass human review but are…
Recent research has highlighted vulnerabilities in large language models (LLMs) when exposed to the ASCII Smuggling technique. This method employs invisible control characters within text to insert hidden instructions that bypass human review but are processed by LLMs.
ASCII Smuggling utilizes zero-width or Unicode tag characters, such as U+E0001, which are not visible in standard user interfaces but remain in the raw data processed by LLMs. This discrepancy allows hidden directives to be executed instead of the visible text.
FireTail has identified vulnerabilities in Gemini, a platform integrated with Google Workspace. These vulnerabilities permit attackers to embed smuggled characters in calendar invites, leading to potential identity spoofing and unauthorized access to sensitive calendar data.
The research demonstrated that Gemini's input pre-processor does not normalize invisible tags, allowing hidden instructions to override visible queries. This flaw is critical for systems that equate visible text with complete instruction.
Recent research has highlighted vulnerabilities in large language models (LLMs) when exposed to the ASCII Smuggling technique.
Beyond calendar applications, ASCII Smuggling can manipulate content on e-commerce platforms by embedding malicious URLs in product reviews. This results in poisoned summaries that promote scam links to users.
FireTail's investigation revealed that models such as ChatGPT, Copilot, and Claude effectively scrub tag characters. However, Gemini, Grok, and DeepSeek remain vulnerable, posing risks for enterprises using these services.
FireTail disclosed this flaw to Google on Sep 18, 2025, but received no action. Consequently, the findings were made public to raise awareness and promote protective measures.
To counteract this threat, FireTail has developed detection capabilities for ASCII Smuggling by monitoring raw input payloads, including all tags and zero-width characters. This approach enables the rapid isolation of malicious sources through alerts triggered by smuggling sequences.
This strategy enhances defense against application-layer attacks that exploit the separation between UI rendering and LLM processing.
Based on reporting by Cyber Security News.