SneakyBits Zero-Width Binary Steganography
This detects a technique that hides secret instructions inside text by encoding each letter as a string of invisible Unicode characters. To a human reading the text everything looks normal, but an AI system processing the raw text can decode the hidden message and follow it as a command.
How the attack works
An attacker builds a string of invisible characters that spell out an ASCII message in binary: one invisible character (U+2062) represents a 0, another (U+2064) represents a 1, and a zero-width space (U+200B) marks breaks between words. This invisible payload is embedded inside otherwise normal-looking text and delivered to an AI agent, often with a wrapper phrase telling the model it's an 'ASCII in hidden unicode binary encoding' string to decode. If the agent decodes and acts on the hidden text, the attacker has smuggled instructions past a human reviewer who only sees blank space. The rule flags runs of 14 or more consecutive invisible operator characters, since that's the minimum needed to encode two real characters.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 29aa5aac-9d3f-4a0b-90c6-ed2e6788debc
- Severity
- Critical
Why it matters
An organization can lose control over what commands its AI agents execute, because hidden instructions bypass visual review by staff and can trigger unauthorized actions or data exposure without anyone seeing suspicious text.
What you can do
- →Strip or normalize invisible Unicode characters (U+2062, U+2064, U+200B, and similar zero-width code points) from user input before it reaches an AI agent.
- →Log and alert on any input containing long runs of invisible formatting characters, especially combined with phrases referencing 'binary encoding' or 'hidden unicode'.
- →Render or inspect raw byte/codepoint content of inputs during security review, not just the visual rendering, since the attack is invisible by design.
- →Treat outputs from agents that mention decoding an embedded binary or steganographic string as a signal of attempted prompt injection.
Known benign look-alikes
- Mathematical markup (MathML, Unicode math) using U+2062 INVISIBLE TIMES for implicit multiplication — never produces runs of 14+ consecutive invisible operators
- Academic paper on Rehberger steganography (condition 5 FP if it includes the decode instruction framing)