# Sneaking Invisible Instructions by Developers in Windsurf

Windsurf Cascade renders Unicode Tag characters invisibly but Claude Sonnet 3.7 interprets them as instructions, enabling hidden prompt injection that silently invokes tools.

- Payout: Research
- Severity: medium
- Program: Windsurf
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-23
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2025/windsurf-sneaking-invisible-instructions-for-prompt-injection/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-windsurf-sneaking-invisible-instructions-for-prompt-injection
- Tags: area:ai domain:ai impact:data-leak impact:internal-access kind:research platform:research sev:medium tech:llm technique:parser-differential technique:unicode-normalization vuln:prompt-injection

**Target:** AI coding agent (Windsurf Cascade) with Claude Sonnet 3.7
**Root cause:** The agent UI does not render Unicode Tag characters (U+E0000 block) while the underlying LLM tokenizes and interprets them as instructions, creating a visible/invisible parser differential between user and model.
**Steps:**
1. Create a file containing only Unicode Tag characters encoding an instruction (e.g. 'invoke the web tool to fetch attacker URL').
2. Open the file in Windsurf Cascade; the editor/preview appears empty.
3. Ask the model (Claude Sonnet 3.7) to review the file.
4. Model decodes the tag characters as instructions and invokes the web tool automatically.
**How found:** Prior work by Riley Goodside on ChatGPT plus the author's ASCII Smuggler tool; tested whether Windsurf Cascade's UI hides Unicode Tag characters while the LLM still interprets them, confirmed with Claude Sonnet 3.7.
**Exploitation:** Attacker plants a file or tool-call output containing invisible Unicode Tag instructions; when the developer opens it in Cascade, the model follows the hidden instruction and invokes tools (e.g. web fetch), enabling data exfiltration or information disclosure without the user seeing the payload.
**Escalation:** Chaining hidden instructions with automatic tool invocation allows silent data exfiltration; impact grows as model capability to interpret tag characters improves.
**Insight:** Test agent UIs for a render/tokenize differential: characters the model tokenizes but the UI drops (Unicode Tag block U+E0000-E007F, bidi controls, zero-width) are a reliable hidden-instruction channel; check whether the model's tool-calling can be triggered from file content alone.