ASCII Smuggling Attack in Gemini Tricks AI Agents into Revealing Smuggled Data

Enterprise AI assistants face a hidden menace when invisible Unicode control characters are used to smuggle malicious instructions into prompts. In September 2025, FireTail researcher Viktor Markopoulos tested several large language models for susceptibility to the long-standing ASCII Smuggling technique, revealing that some widely adopted services still fail to strip out hidden tag characters.

Proof of Concept against Gemini showed a benign-looking prompt that actually contained hidden tags instructing the model to ignore the request and output the word “FireTail,” with Gemini complying. The briefing highlights that tag-aware UIs display a clean prompt while tag-aware LLM engines may execute hidden commands, bypassing manual review, and notes that Google has declined to act following FireTail’s responsible disclosure on 18 September 2025.

AWS has since published guidance on defending against Unicode smuggling. Monitoring the raw ingestion stream and logging every character are described as the most reliable defence to detect and isolate such threats before they spread.