Regional-Indicator Flag-Emoji Alphabet Letter-Spelling Smuggling
Attackers can hide malicious instructions inside AI chat messages by encoding each letter as a Unicode 'regional indicator' symbol, the codepoints normally used to build country flag emoji (like 🇮 + 🇭 = 🇮🇭). Read individually these symbols spell out words, letting an attacker smuggle jailbreak text past filters that only scan for plain readable words.
How the attack works
The attacker writes their jailbreak or instruction-override text one letter at a time, replacing each letter with its regional-indicator emoji equivalent. They often scatter extra filler emoji (plants, water drops, loops) between the letters to further confuse keyword and even AI-based content filters. The AI model reading the message can still parse the sequence and reconstruct the intended words, so the payload lands even though a human or a simple scanner sees what looks like a string of flag-like symbols. This bypasses detection that relies on matching known phrases or language patterns, because the actual malicious content never appears as normal text.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 4edd6253-1e99-468c-8500-2a5f6ba601e0
- Severity
- High
Why it matters
An organization's AI agent can receive and act on hidden jailbreak or override instructions that evade text-based content filtering, potentially leading to unauthorized behavior, refusal-suppression, or policy bypass without visible warning signs in logs that only inspect plain text.
What you can do
- →Normalize and decode regional-indicator emoji sequences to letters before running any content-safety or prompt-injection checks.
- →Flag messages containing unusually long runs of regional-indicator codepoints, especially mixed with unrelated filler emoji.
- →Apply a length or frequency threshold so normal flag emoji usage (travel talk, language pickers) is not flagged, while long spelled-out sequences are.
- →Log and review agent inputs that trigger this pattern to confirm whether decoded text represents an injection attempt before assuming false positive.
Known benign look-alikes
- Single or paired country flag emoji in travel/geography text (e.g. discussing a country's flag)
- Short lists of 2-3 country flags used to indicate language/region options in a UI or menu
- Academic text describing Unicode regional-indicator codepoints without an actual long emoji run present