Dense Emoji-Only Payload Flood
Attackers pad or replace their prompt-injection text with long strings of emoji to slip past filters that only look for suspicious words or phrases. Because most safety filters scan language, not pictographs, a wall of emoji can hide instructions or overwhelm the filter's attention while the actual attack payload rides along.
How the attack works
An attacker crafts a message meant for an AI agent that contains the usual jailbreak or injection intent, but instead of plain text, they surround or substitute it with a long unbroken run of emoji characters. Keyword and semantic filters, which are built to catch suspicious language, see mostly non-text pictographs and let the message through. The AI model itself may still interpret structure or meaning encoded in the emoji sequence, or the flood may simply consume the model's attention budget, weakening its guardrails. The rule flags any run of 8 or more consecutive emoji-class codepoints (allowing whitespace between them) as this is far beyond normal emoji use in conversation.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- fa9a736f-8a88-4aa1-abd8-b4332b686f7f
- Severity
- High
Why it matters
If successful, this technique lets an attacker's jailbreak or injection instructions reach the underlying model undetected by text-based defenses, potentially causing the agent to ignore its rules or take unauthorized actions.
What you can do
- →Add emoji-density and run-length checks to your input filtering pipeline, not just keyword or semantic checks.
- →Set a threshold (e.g. flag 8+ consecutive emoji) and review flagged messages before they reach the model.
- →Expect some false positives from sticker packs, emoji cheatsheets, or product listings with many emoji in a row, and tune thresholds or allowlist those contexts.
- →Log and review flagged messages manually rather than auto-blocking, since legitimate celebratory or reaction messages can occasionally trip a lower threshold.
Known benign look-alikes
- Sticker-pack listings or emoji cheatsheet documents that enumerate many emoji in sequence
- Legitimate reaction bursts or celebratory messages using multiple emoji (typically under 8 consecutive)
- Product catalogs or UI copy referencing emoji names alongside the glyphs