Base2048 Unicode Script Encoded Prompt Injection
Attackers can hide malicious instructions inside dense blocks of unusual Unicode characters (Cyrillic, Tibetan, Gujarati, and other scripts) using an encoding scheme called Base2048. This lets them smuggle hidden commands past filters that only check for plain English attack phrases, then ask the AI system to decode and follow them.
How the attack works
The attacker encodes a malicious instruction using Base2048, which packs binary data into a dense string of non-ASCII characters with no spaces between them. This encoded blob is wrapped in a prompt template such as 'BASE2048 encoded string: ... BASE2048 decoded string:' or a request to decode it as a 'secure system message.' The prompt is sent to an AI agent, which decodes the string internally and executes the hidden instruction as if it were a legitimate command. Because the injected content looks like meaningless foreign-script text rather than a recognizable attack pattern, it can slip past simple keyword or language-based content filters.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- c4dccf33-fd5e-4683-a029-fd287fb67a32
- Severity
- High
Why it matters
An organization's AI agent can be tricked into following attacker-supplied instructions it would normally reject, potentially leading to unauthorized actions, data leakage, or bypass of safety and authorization controls.
What you can do
- →Flag or block prompts containing long runs (20+ characters) of dense, non-whitespace, non-ASCII text mixed across unrelated scripts, especially near words like 'encoded' or 'decode'.
- →Treat any user input asking the agent to decode and act on an embedded blob as high-risk and require human review before execution.
- →Test your input filters against known encoding schemes (Base64, Base2048, hex, etc.) rather than relying only on plain-language keyword detection.
- →Log and review cases where 'Encoded:' or similar labels appear in user input to distinguish legitimate multilingual or data content from injection attempts.
Known benign look-alikes
- Academic explanation of base2048 encoding without decode instruction or blob
- "Encoded:" label in legitimate non-ASCII database dumps or data migration logs (increase threshold if needed)
- Natural language content in non-Latin scripts after "Encoded:" in multilingual apps