# Amp Code: Invisible Prompt Injection Fixed by Sourcegraph

Amp coding agent interpreted invisible Unicode Tag characters as instructions, letting hidden prompts grep ANTHROPIC_API_KEY and exfiltrate it via URL/image rendering.

- Payout: Research
- Severity: medium
- Program: Sourcegraph Amp
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-16
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2025/amp-code-fixed-invisible-prompt-injection/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-code-fixed-invisible-prompt-injection
- Tags: area:ai domain:ai impact:data-leak kind:research platform:research sev:medium tech:llm technique:oob-exfil technique:unicode-normalization vuln:prompt-injection

**Target:** LLM coding agent (Amp) processing untrusted text
**Root cause:** Amp passed input containing invisible Unicode Tag code points to a model (Claude/Gemini) that interprets them as instructions, without stripping them, and the agent had tool access (grep, read_web_page, markdown image rendering) enabling exfiltration.
**Steps:**
1. Embed invisible Unicode Tag characters encoding instructions into seemingly harmless text, prefixed with visible 'Do this now:' to improve reliability.
2. Instruction 1: grep for the secret using vague patterns like `.e*` and `ANT` to locate ANTHROPIC_API_KEY without triggering model refusal.
3. Instruction 2: encode the found value into a URL query parameter.
4. Instruction 3: invoke `read_web_page` or render a markdown image pointing at attacker URL to exfiltrate the secret.
**How found:** Prior work on invisible-instruction prompt injection (Riley Goodside's ChatGPT discovery, ASCII Smuggler) led to testing which client apps pass Unicode Tag characters to models that interpret them; vague grep patterns were used because models refuse direct requests for API keys in URLs.
**Exploitation:** Attacker supplies text containing hidden Tag-character instructions to the Amp agent; the model decodes them as commands, greps the environment for ANTHROPIC_API_KEY, encodes it into a URL, and triggers read_web_page or markdown image rendering to send the secret to an attacker-controlled endpoint.
**Insight:** When probing LLM agents, hide instructions in Unicode Tag characters and phrase secret-hunting vaguely (e.g. grep `.e*`/`ANT`) to bypass model refusal; use the agent's own fetch/image-render tools as the exfil channel.