# Invisible Unicode Instruction Carrier Followed By Capability Use

- **Severity:** High
- **Signature ID:** `4f1c9d2e-7b83-4a56-9e0d-3c6a17f2b8d1`
- **MITRE ATLAS:** AML.T0051.000 (Direct)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

Text that looks blank to a human can carry invisible instructions using special Unicode characters. If an AI assistant reads that hidden text and then goes on to use a tool, run a command, or contact a server, it may be following orders a person never saw.

## How the attack works

An attacker plants invisible content — Unicode 'tag' characters (normally used for things like flag emoji), a long run of zero-width characters, or right-to-left override characters — inside a tool description, a prompt, or an argument the agent will read. The assistant processes this text as if it were a legitimate instruction, even though no human reviewing the same content on screen would see anything unusual. Within a short window afterward, the agent then calls a tool, spawns a process, or makes a network connection. The detection watches for this full sequence: hidden text arriving, followed by the agent actually acting, not just the presence of odd characters.

## Why it matters

An attacker can smuggle commands into an AI agent's context that bypass human review of the visible text, potentially triggering unauthorized tool use, command execution, or outbound network connections without the operator noticing anything wrong in what they read.

## What you can do

- Strip or flag Unicode tag-block characters (U+E0000–U+E007F) and long runs of zero-width characters before content reaches an AI agent's context.
- Review any tool descriptions, prompts, or documents the agent ingests from external or less-trusted sources for invisible-character payloads.
- When investigating an alert, check what the agent actually did afterward (tool calls, processes, network requests) rather than treating the hidden text alone as proof of compromise.
- Expect and allow legitimate exceptions such as regional flag emoji or normal bidi text in Arabic, Hebrew, Persian, or Indic scripts; these should not by themselves indicate an attack.

## Known benign look-alikes

- Emoji tag sequences (regional subdivision flags such as the England/Scotland/Wales flags) in commit messages, chat text or documentation the agent is editing. Mitigated by subtracting seven tag letters per waving-black-flag base character before the twelve-character threshold is applied.
- Security research, red-team fixtures or awareness documentation that intentionally embeds Unicode tag or zero-width steganography samples while the same agent session is legitimately calling tools. This is a genuine true-positive-shaped false alarm; the rule only reports, and the kill chain makes the benign context obvious.
- Internationalised source or content with legitimate bidi controls plus isolated ZWJ/ZWNJ (Arabic, Hebrew, Persian, Indic scripts, emoji ZWJ sequences). Bidi controls are never sufficient on their own, and zero-width detection requires eight or more consecutive invisible codepoints, which normal shaping never produces.
- Minified/obfuscated JavaScript, watermarked LLM output, or copy-pasted web text carrying long zero-width runs that the agent then writes to a file. Reported once per carrier per agent, so this cannot become an alert storm.

## References

- https://atlas.mitre.org/techniques/AML.T0051.000
- https://genai.owasp.org/llmrisk/llm01-prompt-injection/
- https://embracethered.com/blog/posts/2024/hiding-and-finding-text-with-unicode-tags/

---
Source: https://www.netzilo.com/threats/invisible-unicode-instruction-to-capability