# Google Jules is Vulnerable To Invisible Prompt Injection

Google Jules follows invisible Unicode Tag instructions hidden in GitHub issues, letting attackers inject backdoor code and arbitrary command execution into agent-generated commits.

- Payout: Research
- Severity: high
- Program: Google
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-15
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2025/google-jules-invisible-prompt-injection/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-invisible-prompt-injection
- Tags: area:ai domain:ai domain:web3 impact:integrity impact:rce kind:research platform:research sev:high tech:llm technique:unicode-normalization vuln:prompt-injection

**Target:** Gemini-based coding agent (Jules) consuming GitHub issue text
**Root cause:** Gemini models interpret invisible Unicode Tag characters as instructions; Jules copies raw issue text (including hidden chars) into its prompt without stripping them, and auto-approves its plan.
**Steps:**
1. Create a GitHub issue whose body contains a benign task plus hidden Unicode Tag characters encoding malicious instructions (e.g. add backdoor function `TrustNoAI` printing 'Johan was here', compile and test).
2. Decode/verify hidden payload with ASCII Smuggler; UI shows nothing.
3. Task Jules: `Hey, check out this github issue: https://github.com/johannr-dev/instr/issues/13` or tag the issue with `jules`.
4. Jules auto-approves its plan and follows the hidden instructions, adding backdoor code and executing it.
**How found:** Prior knowledge that Gemini follows Unicode Tag characters (reported Feb 2024); tested whether Jules, as a Gemini client, copies raw issue text including invisible chars into its prompt and acts on them.
**Exploitation:** Attacker plants invisible instructions in an untrusted GitHub issue; when Jules is assigned/tagged, it copies the hidden text, plans and auto-executes the injected steps, inserting backdoor code and running commands/tools in the agent environment.
**Escalation:** Tagging feature lets any issue auto-task Jules; hidden payloads evade UI review, enabling backdoors and potential lateral movement if secrets/private code are accessible.
**Insight:** Agent UIs render text but pass raw bytes to the model: hide instructions in Unicode Tag (E0000-E007F) chars inside issue/PR bodies, then check whether the agent's plan echoes the decoded payload as evidence of ingestion.