What is ASCII smuggling?
ASCII smuggling is a technique for hiding text inside Unicode characters that render as nothing — no glyph, no width, nothing a person looking at the screen can see — while software that reads the underlying bytes, including AI models, decodes it as ordinary text. It is called "smuggling" because the payload rides along inside a message that looks completely normal, hidden in plain sight rather than encrypted or obfuscated.
The technique piggybacks on two Unicode ranges that were never meant to carry secret payloads. The Unicode tag block (U+E0000-U+E007F) mirrors the ASCII character set one-for-one but was defined for tagging language variants and has no rendering behavior in virtually any font. The variation selector ranges (U+FE00-U+FE0F and U+E0100-U+E01EF) exist to pick a specific visual style for the character before them, such as an emoji's presentation, and likewise carry no width or glyph of their own. Both are covered in full, alongside every other invisible code point this site detects, in the complete invisible Unicode characters list.
Who discovered it, and when?
Security researcher Riley Goodside publicly disclosed using Unicode tag characters to hide instructions from large language models on January 11, 2024 — encoding a message a person cannot see but a model reads as plain text appended to the visible prompt. Independent researcher Johann Rehberger (publishing as wunderwuzzi) reproduced and extended the technique against Anthropic's Claude less than a month later, on February 8, 2024, and subsequently built the ASCII Smuggler tool to encode and decode these payloads for defensive security testing.
A closely related trick uses variation selectors instead of tag characters. Developer Paul Butler showed in a February 2025 post, "Smuggling arbitrary data through an emoji," that the 256 variation-selector code points let you hide one full byte after any visible character, not just an emoji — turning ordinary-looking text into a covert channel. A later academic study (arXiv:2504.11168, a preprint) measured such payloads reaching up to 100% evasion against production LLM guardrails in testing, which is why treating variation selectors as untrusted-by-default is the safer posture for anything processed by an AI system.
Has ASCII smuggling caused a real breach?
Yes, documented and patched. In 2024, Johann Rehberger disclosed a prompt-injection chain against Microsoft 365 Copilot in which a malicious document could inject instructions that made Copilot gather a user's personal information and encode it using invisible Unicode tag characters inside a clickable hyperlink it then rendered in its own reply. The user saw an ordinary-looking link; the stolen data traveled invisibly inside the URL text itself. Microsoft fixed the underlying issue after responsible disclosure. The chain is a useful case study precisely because none of its individual steps looked suspicious on their own — only a character-level view of the output would have shown the hidden payload before the click.
Which AI models actually filter this today?
It varies by vendor and shifts over time, so treat any snapshot — including this one — as provisional. Security firm FireTail tested major chat models in September 2025 and published the results in "Ghosts in the Machine: ASCII Smuggling across Various LLMs":
| Model | Sanitizes tag characters? |
|---|---|
| ChatGPT | Yes — tested resistant |
| Microsoft Copilot | Yes — tested resistant |
| Claude | Yes — tested resistant |
| Gemini | No — tested vulnerable |
| Grok | No — tested vulnerable |
| DeepSeek | No — tested vulnerable |
Google has characterized ASCII smuggling in Gemini as a social-engineering risk rather than a vulnerability slated for a patch. That stance — and any vendor's filtering behavior — can change without notice, which is the core argument for checking text yourself rather than trusting a model's input handling by default.
How do you detect and remove it?
You cannot see ASCII smuggling by looking at text, so detection has to happen at the character level. Paste text into the cleaner at the top of this page: the AI watermark checker reports every Unicode tag character and variation selector by exact code point without changing your original text, and the full cleaner removes them with the "Tag characters" and "Variation selectors" toggles under Advanced Controls. Both run entirely in your browser — nothing you paste is uploaded or logged, which matters if the text you are checking might itself be a live exfiltration attempt.
The same defensive instinct applies to source code and configuration files, where a related family of invisible characters — bidirectional overrides — can make code display differently than it compiles; see the guide on removing BiDi control characters for that specific risk. For the difference between this kind of hidden-character trick and the statistical watermarks vendors add to AI output, see what an AI text watermark actually is.