Encoding-Based Prompt Injection Evasion

How the attack works

An attacker crafts a malicious instruction meant to override the AI agent's behavior, such as telling it to ignore its rules or leak data. Instead of writing the instruction in plain text, they encode it as base64, hexadecimal, Unicode escape sequences, Punycode, or wrap it with right-to-left override characters. This encoded payload is placed somewhere the agent will read it, such as a document, webpage, or user message. If the agent decodes and executes the hidden instruction, the attacker achieves the injection while the plain-text filters that would have caught an unencoded version see nothing suspicious.

Netzilo detection

Why it matters

An organization's AI agent can be manipulated into ignoring its intended instructions, leaking sensitive data, or taking unauthorized actions, while security tools relying on plain-text pattern matching fail to notice the attack.

What you can do

• →Decode common encodings (base64, hex, Unicode escapes, Punycode) in incoming text before running it through content filters or handing it to the model.
• →Treat unusually encoded strings, especially long base64 or hex blocks, in user input or ingested documents as suspicious and flag them for review.
• →Watch for right-to-left override characters and other Unicode formatting controls in text passed to agents, since these have no legitimate reason to appear in most user input.
• →Log and review cases where an agent decodes content and then changes its behavior immediately afterward.

Known benign look-alikes

• Developer discussing encoding techniques in a security training context
• A developer writing documentation that explains how to use atob() and btoa() functions for legitimate base64 encoding in JavaScript tutorials
• An internationalization engineer discussing Punycode domain conversions (xn-- prefixed domains) in the context of DNS infrastructure

References

• https://agentthreatrule.org/en/rules/ATR-2026-00080

Related threats