What is Unicode tag smuggling?

The Unicode Tag block contains code points that map one to one onto ASCII but display as nothing in almost every application. An attacker encodes an instruction in Tag characters and pastes it inside otherwise normal text. To a person reviewing the content it looks clean, but the model receives the tokens and can interpret the hidden instruction, so the payload travels invisibly wherever the text goes.

Invisible payloads defeat human review, which is often the last line of defence for content that flows into an AI system. Because the instruction hides inside ordinary text, it rides indirect prompt injection through a support ticket, a shared document, a product review, or a web page, and reaches a RAG index or an agent without anyone noticing. It also complicates incident response, since the malicious text is not visible in logs viewed normally.

Strip or reject invisible characters on input. Remove the Tag block and zero-width characters, apply Unicode normalisation, and render or log text in a form that surfaces hidden code points during review. Treat all external text that reaches the model as untrusted, and red-team your ingestion path with Tag-encoded instructions.