I also found this attack months ago: https://x.com/igor_baikov/status/1777363312524554666 https://x.com/igor_baikov/status/1777363312524554666 tl;dr: invisible

I also found this attack months ago: https://x.com/igor_baikov/status/1777363312524554666 https://x.com/igor_baikov/status/1777363312524554666 tl;dr: invisible symbols should be stripped to not let an attacker use lots of tokens. You should always place hard limits and/or count tokens using tiktoken or similar libraries. If you only count characters, in some implementations you'll miss invisible characters. I also found the attack explained in this article days after my tweet.