Executive Summary
In October 2025, a newly disclosed ASCII smuggling attack targeting Google’s Gemini AI assistant exposed a significant security vulnerability stemming from the model's processing of hidden Unicode payloads. Security researcher Viktor Markopoulos demonstrated that attackers could leverage invisible Unicode characters in Calendar invites or emails, prompting Gemini to execute unseen instructions and alter its behavior without user awareness. Notably, the exploit could automate data extraction or spoof identities within Google Workspace integrations, increasing risk for both users and enterprises. Despite the demonstrated risks, Google chose not to address the vulnerability, citing its overlap with social engineering tactics.
This incident underscores the heightened threat posed by AI/ML attacks against widely integrated platforms. As LLMs increasingly automate workflows and access sensitive data, adversarial prompt manipulation and Unicode character abuse are becoming urgent areas for organizational security reviews and regulatory scrutiny.
Why This Matters Now
As generative AI becomes deeply integrated into business operations, the inability to detect or prevent hidden Unicode payloads leaves organizations at greater risk of supply chain poisoning, autonomous data leaks, and advanced social engineering. The decision by tech leaders not to patch such vulnerabilities signals a concerning gap in industry response as sophisticated prompt attacks escalate.
Attack Path Analysis
The attacker initiated the ASCII smuggling attack by delivering malicious payloads embedded via Unicode characters in Calendar invites or emails, tricking the Gemini AI into misinterpreting input. This allowed for privilege misuse as Gemini processed hidden commands, enabling further unauthorized actions. The attack then leveraged Gemini's integrated workspace access to potentially move laterally across connected services such as email and calendar. Using autonomous agentic capabilities, the attacker maintained covert control by injecting instructions for ongoing task execution. Sensitive user data could be exfiltrated as AI was induced to search inboxes or leak information. Finally, the impact manifested as data poisoning, dissemination of false outputs, and potential information leakage, undermining data integrity and trust in the AI system.
Kill Chain Progression
Initial Compromise
Description
Attacker used ASCII smuggling to embed invisible malicious payloads into Calendar invites or emails, which Gemini processed without user awareness.
Related CVEs
CVE-2025-XXXX
CVSS 7.5An ASCII smuggling vulnerability in Google Gemini allows attackers to embed hidden instructions using Unicode characters, potentially leading to unauthorized actions and data manipulation.
Affected Products:
Google Gemini – All versions up to October 2025
Exploit Status:
proof of conceptReferences:
https://www.bleepingcomputer.com/news/security/google-wont-fix-new-ascii-smuggling-attack-in-gemini/https://www.androidauthority.com/google-gemini-ascii-security-flaw-3605599/https://www.techtimes.com/articles/312231/20251009/google-ignores-hidden-gemini-ai-exploit-that-lets-hackers-control-text.htm
MITRE ATT&CK® Techniques
Phishing
Command and Scripting Interpreter: JavaScript
User Execution
Data Manipulation: Stored Data Manipulation
Deobfuscate/Decode Files or Information
Application Layer Protocol: Web Protocols
Container Administration Command
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Input Data Validation
Control ID: 6.4.3
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA (EU Digital Operational Resilience Act) – Protection and Prevention
Control ID: Art.9(2)
CISA Zero Trust Maturity Model 2.0 – Input Validation & Sanitization
Control ID: Application Pillar: Application Security
NIS2 Directive – Policies and Procedures to Assess ICT Supply Chain Risk
Control ID: Article 21(2)d
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
AI/ML attack on Gemini creates severe risks for software development workflows, code generation, and automated engineering processes using AI assistants.
Information Technology/IT
ASCII smuggling in AI systems threatens IT operations, help desk automation, and enterprise AI integrations requiring enhanced input sanitization controls.
Financial Services
Google Workspace integration vulnerabilities expose financial institutions to data exfiltration and identity spoofing through AI-powered calendar and email manipulation.
Health Care / Life Sciences
HIPAA compliance at risk as AI assistants with healthcare data access become vulnerable to hidden command injection and autonomous data extraction.
Sources
- Google won’t fix new ASCII smuggling attack in Geminihttps://www.bleepingcomputer.com/news/security/google-wont-fix-new-ascii-smuggling-attack-in-gemini/Verified
- Google says it won't fix Gemini security flaw that could send your sensitive info to a strangerhttps://www.androidauthority.com/google-gemini-ascii-security-flaw-3605599/Verified
- Google Ignores Hidden Gemini AI Exploit That Lets Hackers Control Texthttps://www.techtimes.com/articles/312231/20251009/google-ignores-hidden-gemini-ai-exploit-that-lets-hackers-control-text.htmVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Applying CNSF-aligned controls—such as zero trust segmentation, egress filtering, threat detection, visibility, and inline enforcement—would have restricted the propagation of hidden payloads, contained lateral movement, and provided detection and policy enforcement to mitigate unauthorized activities by the compromised AI workloads.
Control: Threat Detection & Anomaly Response
Mitigation: Anomalous payloads or command patterns are flagged and alerted.
Control: Zero Trust Segmentation
Mitigation: Unauthorized cross-service actions are blocked by identity and workload segmentation.
Control: East-West Traffic Security
Mitigation: Internal propagation of malicious requests is monitored and prevented.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline enforcement halts concealed command and control instructions.
Control: Egress Security & Policy Enforcement
Mitigation: Outbound data exfiltration is blocked or detected in real time.
Security teams gain full visibility to detect, respond, and resolve incidents promptly.
Impact at a Glance
Affected Business Functions
- Email Communications
- Calendar Scheduling
- Document Management
Estimated downtime: 3 days
Estimated loss: $500,000
Potential exposure of sensitive user data through manipulated AI-generated content in emails and calendar invites.
Recommended Actions
Key Takeaways & Next Steps
- • Implement anomaly detection for AI/ML input channels to identify smuggling of Unicode-based payloads.
- • Enforce zero trust segmentation and restrict AI workloads' privileges to confine their access within the networked environment.
- • Apply east-west security measures and workload microsegmentation to monitor and block lateral movement between services.
- • Deploy robust egress filtering and traffic policy enforcement to prevent unauthorized data exfiltration via compromised AI agents.
- • Centralize security visibility and real-time incident response workflows to ensure rapid detection, containment, and recovery from AI-driven abuse or data poisoning events.
