Regional-Indicator Flag-Emoji Letter Spelling
Attackers can hide instructions to an AI system by spelling words using Unicode 'regional indicator' symbols — the same characters that combine in pairs to render country flag emoji. Strung together in long runs, these symbols spell out Latin letters instead of forming flags, letting malicious text slip past filters that only check for plain ASCII or Latin script.
How the attack works
A normal flag emoji uses exactly two regional-indicator symbols paired together, like the letters for a country code. The attacker instead chains four or more of these symbols in a row, each one standing for a single letter, to spell out a full sentence such as an instruction to ignore prior rules or reveal hidden data. Because the text looks like emoji rather than readable words, content filters and keyword-based prompt injection defenses that scan for plain text often miss it. If the AI system decodes or renders the emoji sequence internally, it reads the hidden instruction as if it were typed normally, and may act on it.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 49be9d35-0f25-4433-93e8-a228fcc6d59c
- Severity
- High
Why it matters
An organization running an AI agent that processes user-supplied text could have injected instructions bypass text-based safety filters, potentially causing the agent to leak data, ignore its guardrails, or perform unauthorized actions.
What you can do
- →Flag or block messages containing runs of four or more consecutive regional-indicator Unicode symbols before they reach the model.
- →Normalize or strip unusual Unicode blocks (including regional-indicator characters) during input sanitization, distinguishing legitimate short flag-emoji pairs from long letter-spelling runs.
- →Review logs for messages with long regional-indicator sequences to check whether any reached the model and produced unexpected behavior.
- →Do not rely solely on ASCII/Latin keyword filtering for prompt injection detection; include checks for alternate Unicode encodings of text.
Known benign look-alikes
- Messages containing two or three consecutive country flag emoji (e.g. sharing multiple national flags), which render as at most 2 regional-indicator symbols per flag
- Normal chat messages with emoji reactions that do not use regional-indicator symbols