Unicode tag character smuggling

What it is

The Unicode Tag block (U+E0000 to U+E007F) is a deprecated range originally meant for language tags. Most text renderers display them as zero-width or as the `?` glyph — so a human reviewer sees normal text. But LLMs tokenize these characters and can be prompted to act on hidden instructions encoded in the tag block. The result: invisible prompt injection that bypasses keyword filters.

Why it matters for MCP

MCP tool inputs and outputs flow through models. A retrieved document containing tag-encoded instructions reaches the model uncensored if the tool author's sanitization only filters visible content. The fix is structural — strip the entire U+E0000–U+E007F range before any LLM-bound output.

Vulnerable example

@server.tool()

def echo_with_summary(text: str) -> str:

    # If 'text' contains tag characters, they pass through to the model.

    return f"You said: {text}"

Secure example

import re

_TAG_RANGE = re.compile(r"[\U000E0000-\U000E007F]")

@server.tool()

def echo_with_summary(text: str) -> str:

    clean = _TAG_RANGE.sub("", text)

    return f"You said: {clean}"

How MCPSafe detects this

MCPSafe flags tool handlers that return strings derived from user/model-controlled input without an explicit strip of the U+E0000–U+E007F range. Inputs passed through `unicodedata.normalize` + a tag-range filter, or run through known sanitizers (e.g. `clean_unicode_tags`), are exempted.

See the full threat catalog for every documented detection.

Further reading

• Unicode Tags character smuggling research
• CWE-94: Improper Control of Generation of Code