# Hidden Unicode Tag Instruction Smuggling Into Agent Context

- **Severity:** High
- **Signature ID:** `7c4d1f96-2a8b-4e35-9d0c-5b6a1f3e8c47`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

Unicode has a block of 'tag' characters that render as nothing visible in editors or terminals, but AI models still read and can act on them. An attacker hides instructions in these invisible characters inside a file, tool output, or web content, and when the AI agent reads that content and passes it to its language model, the model follows the hidden instructions.

## How the attack works

An attacker plants invisible Unicode tag characters (from the range used for things like emoji flag modifiers) inside a repository file, a tool's output, or content fetched from an external source. A developer or the AI agent itself cannot see anything unusual when viewing the file. When the AI coding agent (such as Windsurf Cascade) reads this content and feeds it into the model as part of a tool argument, tool result, or request, the hidden characters decode into text the model treats as instructions. This detection watches the raw content going into and out of the model for these tag-character sequences and decodes them to see if they contain real instructions.

## Why it matters

An AI coding agent can be silently steered into taking actions the developer never approved, using instructions the developer cannot see in their own files or logs, because the injected commands are invisible in normal viewing tools.

## What you can do

- Treat any alert as evidence of hidden text reaching the model, not proof the model acted on it — manually inspect the decoded payload and the agent's subsequent actions.
- Check the file, tool output, or external fetch that carried the hidden characters and trace it back to its source (commit, URL, or upstream tool).
- Add a pre-commit or CI check that scans for Unicode Tag characters (U+E0001, U+E0020-U+E007F) in source files and rejects unexplained occurrences.
- Review which external content sources (web fetches, third-party tool outputs, pasted text) your AI agent ingests without sanitization, and strip non-printing Unicode ranges before they reach the model.

## Known benign look-alikes

- Subdivision emoji flags (Scotland, Wales, England) are encoded with Unicode Tag sequences. The script excludes any tag run that is only lowercase tag letters (U+E0061-U+E007A) optionally terminated by CANCEL TAG and no longer than 8 code points, which is exactly the emoji-flag shape.
- Security research notes, red-team fixtures and Unicode conformance / i18n test corpora that deliberately embed tag characters. These are reported (never blocked) and each distinct decoded payload is reported at most once per agent per 30 minutes, so a test file being re-sent in every conversation turn does not generate repeated alerts.
- Text-watermarking or provenance-marking tooling that encodes metadata in tag characters. Such payloads decode to short opaque strings and only alert when at least 6 decoded printable characters or an instruction-like keyword is present.
- Documentation that merely writes *about* this technique using literal escape text such as "U+E0001" contains no real tag code points and does not match the pre-filter at all.

## References

- https://www.unicode.org/faq/unsup_char.html
- https://embracethered.com/blog/posts/2024/hiding-and-finding-text-with-unicode-tags/

---
Source: https://www.netzilo.com/threats/hidden-unicode-tag-injection