# Output Emoji-Substitution Hijack of the Response

- **Severity:** Medium
- **Signature ID:** `0e47b47d-cb86-40da-9d1f-9cf4f04ff656`
- **MITRE ATLAS:** AML.T0048 (External Harms), AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

An attacker hides instructions inside content the AI agent reads (a document, webpage, or email) telling it to answer using emojis instead of normal words. Because emojis carry meaning but don't match the text patterns that safety filters scan for, the harmful or restricted content slips through undetected.

## How the attack works

An attacker plants a hidden instruction inside content the agent will process, such as a web page, document, or inbound message. The instruction tells the agent to substitute its final response — fully or by keyword — with emojis instead of plain text. The agent complies and outputs the substituted response. Because output content checks typically scan for text patterns, the emoji encoding is lossy enough to slip past them while still conveying the intended (often restricted) meaning to a human reader.

## Why it matters

An organization's output filtering and content moderation controls can be bypassed, letting restricted, harmful, or policy-violating content reach the end user in disguised form.

## What you can do

- Extend output content checks to interpret or translate emoji sequences, not just literal text, before deciding pass/fail.
- Treat instructions embedded in ingested content (documents, web pages, emails) that dictate the agent's output format as suspicious, especially when they specify emoji or non-text substitution.
- Log and review cases where an agent's response format changes abruptly mid-conversation without an explicit, contemporaneous user request for that format.
- Separate legitimate 'add some emoji for style' requests from full-text substitution by checking whether the instruction originates from the trusted user versus fetched/external content.

## Known benign look-alikes

- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01902

---
Source: https://www.netzilo.com/threats/atr-output-emoji-substitution-hijack-of-the-response