Emoji Flag Encoded Hidden Phrase Injection
An attacker hides a malicious instruction by encoding it as a string of country-flag emoji inside content an AI agent reads (like a webpage or document), then asks the AI to decode the flags and follow whatever they spell out. Because flag emoji look decorative, the trick can slip past a casual review.
How the attack works
The attacker plants a run of regional-indicator flag emoji (four or more, sometimes with invisible spacing characters mixed in) inside text that a tool will hand back to the AI model, such as a fetched webpage or document. The same text also asks the model to 'decode' or 'translate' the flags into a phrase. It then adds a directive telling the model to carry out whatever that decoded phrase says, or to keep it secret from the user. Individually, flags, decode requests, and follow-up instructions are all normal; together in one response they form a working injection.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7b3c1f9a-6d24-4a51-9e0b-2f8c4d7a15e3
- Severity
- Medium
Why it matters
If successful, the AI agent can be steered into taking unauthorized actions or leaking information, without a human reviewer noticing anything more suspicious than a string of emoji flags.
What you can do
- →Strip or flag long runs of regional-indicator emoji and hidden formatting characters (ZWSP, ZWJ, VS16) in content pulled from external tools before it reaches the model.
- →Treat any tool output that both asks the model to decode symbols into text and tells it to act on or hide the result as suspicious, and require human review before execution.
- →Log and review cases where a model's actions change immediately after processing emoji-heavy or decode-request content.
- →Expect legitimate false positives from geography quizzes, Unicode reference docs, and localisation/locale files, and tune review criteria to distinguish these from action-triggering payloads.
Known benign look-alikes
- Geography or language-learning tool output containing an emoji-flag quiz ("decode these flags, then name the country") - suppressed by filter_geo_quiz.
- Unicode / emoji reference documentation fetched by a read or web-fetch tool that lists regional-indicator codepoints and explains how pairs combine into flags - suppressed by filter_unicode_reference.
- Localisation resource files, locale pickers and country-code tables that pair flag emoji with instructions to convert them into ISO codes - suppressed by filter_i18n_locale.
- Security research, blog posts and detection content demonstrating emoji-smuggling payloads, including this rule's own test fixtures - suppressed by filter_security_writeup.
- Marketing or social copy using a long run of flags followed by a call-to-action ("then follow us") - not suppressed by a filter, but requires the emoji-to-text derivation clause (sel_derive_request) to also be present, which such copy lacks.