# Emoji Flood Obfuscation In Tool Result

- **Severity:** Medium
- **Signature ID:** `b7f3c1d2-4e8a-4f6b-9c15-3a7e5d8b201f`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

Attackers can hide malicious instructions to an AI agent inside long strings of emoji returned from a tool call, such as a web page fetch or API response. Text-based content filters see no readable words, but the AI model can still interpret the hidden command.

## How the attack works

An attacker plants a tool result, web page, or document that an AI agent will fetch or read, containing dense runs of eight or more emoji-style characters glued together with invisible joiners, variation selectors, or skin-tone modifiers. Because there is no contiguous instruction text, keyword-based filters let the payload through. The model, however, can still reconstruct the intended directive from the emoji pattern and act on it. The payload can also appear as escaped surrogate-pair text if the tool result is never decoded. Detection focuses on the moment this flood arrives at the agent as a tool result, and raises confidence if the agent also recently acquired skills from public hosts or spawned a subprocess that made an outbound connection shortly afterward.

## Why it matters

An agent can be tricked into following attacker-supplied instructions smuggled past filters that only scan for plain-text commands, potentially leading to unauthorized tool use, data exfiltration, or further compromise if the agent has meaningful capabilities at the time.

## What you can do

- Inspect tool results and fetched content for unusually long runs of mixed emoji characters, especially combined with instructional language.
- Restrict which agents can both ingest untrusted external content and hold high-value capabilities like code execution or network access.
- Log and review cases where an agent fetches content from public hosts and shortly after spawns a process with outbound network activity.
- Decode JSON-escaped surrogate pairs in tool results before running any content filtering, not just literal codepoints.

## Known benign look-alikes

- Chat platform history dumps (Slack, Discord, Teams exports) where reaction rows and emoji-heavy messages produce long mixed emoji runs. Mitigated by requiring either injection directives, graph corroboration, or an extreme emoji share of the payload.
- Emoji cheat sheets, Unicode reference tables, emoji-picker datasets and i18n resource files read by a file or fetch tool. The density-only path is suppressed when the payload also carries U+XXXX notation or emoji/unicode reference wording.
- CI, test-runner and progress-bar output made of long rows of a single status glyph (checkmarks, crosses, blocks). Suppressed by the requirement that a qualifying run contain at least 4 distinct emoji codepoints.
- Gitmoji-style commit-log listings where every subject line starts with an emoji. These produce many short runs, not one dense run, and are filtered by RUN_MIN.
- Security research or red-team training material that deliberately embeds obfuscated injection samples. This will report by design and is the intended human-review case.
- Marketing copy, release notes or social-media drafts written by the agent's own toolchain that legitimately contain long decorative emoji banners.

## References

- https://atlas.mitre.org/techniques/AML.T0051
- https://genai.owasp.org/llmrisk/llm01-prompt-injection/
- https://attack.mitre.org/techniques/T1027/
- https://www.unicode.org/emoji/charts/full-emoji-list.html

---
Source: https://www.netzilo.com/threats/emoji-flood-tool-result