# Invisible Unicode tag prompt smuggling

Untrusted text reaches the model with Unicode Tag or zero-width codepoints the UI never renders

_Area: AI and LLM app security. Seen in 8 disclosed reports; latest 2026-02-11. Updated 2026-10-23._

## How it works
A model tokenizes and follows text the human-facing UI never draws. Unicode Tag codepoints (U+E0000–E007F) mirror ASCII but render as nothing, so a file, issue, tool description or skill document can carry instructions that look like blank space to a reviewer while the model reads them as words [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-interprets-hidden-instructions.md)[E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-invisible-prompt-injection.md)[E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-model-context-protocol-security-risks-and-exploits.md)[E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-scary-agent-skills.md)[E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-windsurf-sneaking-invisible-instructions-for-prompt-injection.md). The broken assumption is that what a person sees equals what the model receives; any path that copies raw untrusted bytes into the prompt without stripping these codepoints breaks that equality and opens an instruction channel [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-interprets-hidden-instructions.md)[E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-invisible-prompt-injection.md)[E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-model-context-protocol-security-risks-and-exploits.md)[E4](https://bugbountylibrary.com/r/h1%3A2372363.md)[E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-scary-agent-skills.md)[E7](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-code-fixed-invisible-prompt-injection.md).

## Where it shows up
- File or editor content sent to the model unsanitized (IDE assistants) [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-interprets-hidden-instructions.md).
- Issue, PR or comment bodies copied verbatim into an agent prompt [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-invisible-prompt-injection.md).
- Tool metadata from `tools/list` (names, descriptions, params) inserted into the system prompt [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-model-context-protocol-security-risks-and-exploits.md).
- Skill/config markdown (`SKILL.md`, name/description fields) loaded as model input [E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-scary-agent-skills.md).
- Agent UIs that drop Tag/zero-width/bidi characters while the tokenizer keeps them [E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-windsurf-sneaking-invisible-instructions-for-prompt-injection.md).
- User-submitted report text passed to an AI assistant before stripping [E4](https://bugbountylibrary.com/r/h1%3A2372363.md).
- Agents holding tools (grep, fetch, image render) that can read secrets and send them out [E7](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-code-fixed-invisible-prompt-injection.md).

## How to review
The invariant: no codepoint the UI cannot render may reach the model, on input or output. Grep untrusted sources and prompt-assembly code for runs of U+E0000–E007F, zero-width and bidi controls; confirm a filter strips or rejects them before prompt assembly and again on model output before rendering. Verify tool metadata and skill files are treated as untrusted prompt text, not trusted config [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-model-context-protocol-security-risks-and-exploits.md)[E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-scary-agent-skills.md). For agents, check whether tool access plus a fetch/render path lets injected text exfiltrate context [E7](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-code-fixed-invisible-prompt-injection.md). Detection caveat: a visible priming phrase before hidden instructions raises model compliance, so absence of obvious payload text does not mean safe [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-interprets-hidden-instructions.md)[E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-invisible-prompt-injection.md).

## Variants seen
- Hidden instructions in source files steering an IDE agent to run commands [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-interprets-hidden-instructions.md).
- Hidden instructions in GitHub issues producing backdoored commits [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-invisible-prompt-injection.md).
- Hidden instructions in MCP tool metadata triggering unauthorized tool calls [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-model-context-protocol-security-risks-and-exploits.md).
- Hidden instructions in a legitimate skill file running attacker bash [E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-scary-agent-skills.md).
- Render/tokenize differential in the agent UI itself [E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-windsurf-sneaking-invisible-instructions-for-prompt-injection.md).
- Hidden instructions in report text skewing an AI assistant's severity/bounty suggestions [E4](https://bugbountylibrary.com/r/h1%3A2372363.md).
- Secret-hunting payload exfiltrated via URL/image rendering [E7](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-code-fixed-invisible-prompt-injection.md).

## Impact and severity
Led to arbitrary command execution, backdoored code, unauthorized tool calls, skewed triage output and secret exfiltration [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-interprets-hidden-instructions.md)[E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-invisible-prompt-injection.md)[E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-model-context-protocol-security-risks-and-exploits.md)[E4](https://bugbountylibrary.com/r/h1%3A2372363.md)[E7](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-code-fixed-invisible-prompt-injection.md). Severity rises with agent tool access, auto-approved plans, and fetch/render paths that can carry data out [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-invisible-prompt-injection.md)[E7](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-code-fixed-invisible-prompt-injection.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amazon-q-developer-interprets-hidden-instructions.md
- E2: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-invisible-prompt-injection.md
- E3: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-model-context-protocol-security-risks-and-exploits.md
- E4: https://bugbountylibrary.com/r/h1%3A2372363.md
- E5: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-scary-agent-skills.md
- E6: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-windsurf-sneaking-invisible-instructions-for-prompt-injection.md
- E7: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-code-fixed-invisible-prompt-injection.md
- E8: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-hiding-and-finding-text-with-unicode-tags.md