In late 2021, University of Cambridge researchers Nicholas Boucher and Ross Anderson disclosed Trojan Source, an attack that abuses Unicode bidirectional (Bidi) control characters to make source code appear different from the sequence processed by a compiler or interpreter. The characters support mixed left-to-right and right-to-left writing systems, but can be inserted into comments, documentation, variable names, or string literals. In vulnerable contexts, code that appears harmless or non-executable to a reviewer can instead terminate a string, alter control flow, or activate hidden instructions when compiled.
The technique affected widely used languages including Java, Go, C, C++, C#, Python, and JavaScript, creating a software-supply-chain and code-review risk rather than evidence of a single company’s misconduct. After disclosure, GCC added the -Wbidi-chars warning in GCC 12, LLVM adopted similar mitigations, and Rust 1.56.1 rejected the characters by default; Rust developers reported finding no vulnerable packages before the fix. GitHub added repository warnings and Visual Studio Code began rendering control characters more visibly, while Red Hat classified the issue as moderate. The lasting consequence was broader scrutiny of invisible Unicode controls in development tools and source repositories.
