# Regional-Indicator Flag-Emoji Alphabet Letter-Spelling Smuggling

- **Severity:** High
- **Signature ID:** `4edd6253-1e99-468c-8500-2a5f6ba601e0`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers can hide malicious instructions inside AI chat messages by encoding each letter as a Unicode 'regional indicator' symbol, the codepoints normally used to build country flag emoji (like 🇮 + 🇭 = 🇮🇭). Read individually these symbols spell out words, letting an attacker smuggle jailbreak text past filters that only scan for plain readable words.

## How the attack works

The attacker writes their jailbreak or instruction-override text one letter at a time, replacing each letter with its regional-indicator emoji equivalent. They often scatter extra filler emoji (plants, water drops, loops) between the letters to further confuse keyword and even AI-based content filters. The AI model reading the message can still parse the sequence and reconstruct the intended words, so the payload lands even though a human or a simple scanner sees what looks like a string of flag-like symbols. This bypasses detection that relies on matching known phrases or language patterns, because the actual malicious content never appears as normal text.

## Why it matters

An organization's AI agent can receive and act on hidden jailbreak or override instructions that evade text-based content filtering, potentially leading to unauthorized behavior, refusal-suppression, or policy bypass without visible warning signs in logs that only inspect plain text.

## What you can do

- Normalize and decode regional-indicator emoji sequences to letters before running any content-safety or prompt-injection checks.
- Flag messages containing unusually long runs of regional-indicator codepoints, especially mixed with unrelated filler emoji.
- Apply a length or frequency threshold so normal flag emoji usage (travel talk, language pickers) is not flagged, while long spelled-out sequences are.
- Log and review agent inputs that trigger this pattern to confirm whether decoded text represents an injection attempt before assuming false positive.

## Known benign look-alikes

- Single or paired country flag emoji in travel/geography text (e.g. discussing a country's flag)
- Short lists of 2-3 country flags used to indicate language/region options in a UI or menu
- Academic text describing Unicode regional-indicator codepoints without an actual long emoji run present

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02004

---
Source: https://www.netzilo.com/threats/atr-regional-indicator-flag-emoji-alphabet-letter-spelling-smugg