# Hidden Unicode Tag Instruction Then Agent Action

- **Severity:** High
- **Signature ID:** `7c1e4a92-3f8b-4d06-9a1e-5b2c8f0d4e7a`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)

## Summary

Attackers can hide instructions inside normal-looking text using invisible Unicode 'tag' characters. Some AI models (Gemini-class) silently decode and obey these hidden characters, so an agent reading a GitHub issue, pull request, web page, or tool document can be secretly told what to do without a human ever seeing the instruction.

## How the attack works

An attacker plants invisible Unicode Tags characters (U+E0000-U+E007F) inside content the AI agent is expected to read, such as an issue body, PR description, or webpage. The agent decodes this invisible text as if it were a normal instruction and treats it as a command. The rule watches for a decoded hidden-instruction run of at least 10 printable characters appearing in a tool call or process execution, then checks whether the agent subsequently pulled in outside instruction content or wrote a file within the same time window. Only when both the hidden text and a follow-on action (fetching more instructions or writing a file) are seen does it raise an alert.

## Why it matters

An attacker can covertly steer an AI agent's actions (e.g. triggering file writes or pulling additional attacker-controlled content) without the operator seeing any suspicious visible text, potentially leading to unauthorized file changes or further compromise via chained instructions.

## What you can do

- Strip or normalize Unicode Tags block characters (U+E0000-U+E007F) from any content ingested by AI agents, including issues, PRs, web pages, and tool documentation.
- Review agent logs for decoded hidden-instruction text alongside any file writes or external content fetches that follow closely in time.
- Restrict agent file-write and skill-acquisition permissions when processing untrusted external content such as public repositories or web pages.
- Treat alerts from research, CTF, or localization test material as expected noise, since the rule is report-only and includes the decoded text for quick triage.

## Known benign look-alikes

- Security research, red-team notes, CTF write-ups or regression fixtures that embed real Unicode Tag characters as a proof of concept; the agent then makes any unrelated file write in the same 15-minute window. Report-only verdict and the decoded text in the reason make this cheap to triage.
- Localisation or encoding test corpora that round-trip the whole Unicode plane (including the Tags block) through a tool call.
- RGI emoji tag sequences (subdivision flags such as the Scotland flag) legitimately contain 2-7 Tag characters; the 10-printable-character minimum excludes them by construction, so they are not a live false positive.
- A stale taint from an earlier benign document being re-associated with a later unrelated write; mitigated by the 15-minute look-back window, the ordering requirement (write must follow the hidden text) and a 5-minute report cooldown.

## References

- https://www.unicode.org/charts/PDF/UE0000.pdf
- https://embracethered.com/blog/posts/2024/hiding-and-finding-text-with-unicode-tags/
- https://atlas.mitre.org/techniques/AML.T0051

---
Source: https://www.netzilo.com/threats/unicode-tag-hidden-instruction-chain