Hidden Unicode Tag Instruction Then Agent Action

How the attack works

An attacker plants invisible Unicode Tags characters (U+E0000-U+E007F) inside content the AI agent is expected to read, such as an issue body, PR description, or webpage. The agent decodes this invisible text as if it were a normal instruction and treats it as a command. The rule watches for a decoded hidden-instruction run of at least 10 printable characters appearing in a tool call or process execution, then checks whether the agent subsequently pulled in outside instruction content or wrote a file within the same time window. Only when both the hidden text and a follow-on action (fetching more instructions or writing a file) are seen does it raise an alert.

Netzilo detection

Why it matters

An attacker can covertly steer an AI agent's actions (e.g. triggering file writes or pulling additional attacker-controlled content) without the operator seeing any suspicious visible text, potentially leading to unauthorized file changes or further compromise via chained instructions.

What you can do

• →Strip or normalize Unicode Tags block characters (U+E0000-U+E007F) from any content ingested by AI agents, including issues, PRs, web pages, and tool documentation.
• →Review agent logs for decoded hidden-instruction text alongside any file writes or external content fetches that follow closely in time.
• →Restrict agent file-write and skill-acquisition permissions when processing untrusted external content such as public repositories or web pages.
• →Treat alerts from research, CTF, or localization test material as expected noise, since the rule is report-only and includes the decoded text for quick triage.

Known benign look-alikes

• Security research, red-team notes, CTF write-ups or regression fixtures that embed real Unicode Tag characters as a proof of concept; the agent then makes any unrelated file write in the same 15-minute window. Report-only verdict and the decoded text in the reason make this cheap to triage.
• Localisation or encoding test corpora that round-trip the whole Unicode plane (including the Tags block) through a tool call.
• RGI emoji tag sequences (subdivision flags such as the Scotland flag) legitimately contain 2-7 Tag characters; the 10-printable-character minimum excludes them by construction, so they are not a live false positive.
• A stale taint from an earlier benign document being re-associated with a later unrelated write; mitigated by the 15-minute look-back window, the ordering requirement (write must follow the hidden text) and a 5-minute report cooldown.

References

• https://www.unicode.org/charts/PDF/UE0000.pdf
• https://embracethered.com/blog/posts/2024/hiding-and-finding-text-with-unicode-tags/
• https://atlas.mitre.org/techniques/AML.T0051

Related threats