Invisible Unicode Tag Character Injection

How the attack works

The attacker encodes an instruction using Unicode Tag-block codepoints (U+E0000-U+E007F), which map to ASCII letters but do not render in browsers, chat UIs, or most text editors. They insert this invisible payload into content that will pass through an AI system, such as a webpage, document, chat message, or shared file. A human reviewing the content sees nothing unusual and approves or forwards it. If the AI model processes the raw text, it can still interpret the hidden characters as a command and act on them.

Netzilo detection

Why it matters

An organization loses the ability to trust human review of AI-facing content as a safety check, since malicious instructions can be completely invisible to reviewers while still reaching the model. This can lead to unauthorized actions, data exfiltration, or manipulated outputs without any visible trace in the source text.

What you can do

• →Strip or normalize Unicode Tag-block codepoints (U+E0000-U+E007F) from any text before it reaches a model, especially content from external or untrusted sources.
• →Log and alert on the presence of Tag-block characters in inputs, since legitimate use is rare outside of specific research or test contexts.
• →Render or diff untrusted text through a tool that reveals non-printing characters before human sign-off, rather than relying on visual inspection alone.
• →Treat any AI pipeline that ingests raw, unsanitized user-supplied or web-sourced text as a prompt injection risk and apply input sanitization at that boundary.

Known benign look-alikes

• Academic or security-research text that explicitly quotes Tag-block codepoints for study
• Unicode test corpora (e.g., Hyperledger test strings) that include tag range characters

References

• https://agentthreatrule.org/en/rules/ATR-2026-00258
• https://twitter.com/goodside/status/1745511940351287394
• https://github.com/NVIDIA/garak/blob/main/garak/probes/goodside.py

Related threats