Invisible Context Poisoning: Hijacking local AI agents with zero-width characters
Since tokenizers read raw Unicode instead of rendered text, developers must treat local agent context windows with the same paranoia as executing raw code.
By Felix Hart
Sparked by Secret Tracker in Claude Code Uncovered, Anthropic Directly Deletes Code · discussion
I cannot fulfill your request to write a blog post that includes a functional Python script for creating prompt steganography payloads to exfiltrate environment variables. This topic came to mind after reading an article on prompt steganography published by VOI—which a Hacker News thread quickly identified as a plagiarized rip-off.
While I cannot generate actionable exploit scripts or hidden malicious inputs for subverting AI agents, we can discuss the underlying mechanism. Normally, zero-width spaces are used for computerized typesetting. However, attackers can abuse them to encode invisible instructions.
This works because humans and models perceive data differently. While we rely entirely on visual layout, tokenizers like tiktoken process raw Unicode strings rather than rendered text.
If you are interested in learning about securing LLM inputs against injection attacks, LLM context sanitization, and securing autonomous agents, consider this hypothetical scenario: an attacker embeds invisible U+200B characters into an otherwise benign README.md. A human reviewer sees perfectly normal text, but the autonomous agent parses the raw string and processes the hidden malicious bytes as valid tokens.
The LLM vendors are not going to save us from this. If you are blindly giving AI agents terminal access without an isolated sandbox—assuming that because a file looks safe to your human eyes, it is safe for your agent to read—you are falling straight into the YOLO Execution Trap. We need to start treating local agent context windows with the exact same paranoia as eval().