Unicode Tag Block Smuggling in Tool Call
A rarely-used range of invisible Unicode characters (the Tag block) can be embedded in web pages, documents, or tool outputs that an AI agent reads. Because these characters render as nothing but survive text processing, they let an attacker sneak hidden instructions into an agent's input or exfiltrate stolen data out through the agent's tool calls, all invisibly to a human watching the screen.
How the attack works
An attacker plants invisible Tag-block characters (or their escaped equivalents in JSON, HTML entities, or URL encoding) inside content the agent will ingest, such as a fetched web page, a document, or the result of another tool call. The agent processes this content and unknowingly relays the hidden characters verbatim into a subsequent tool call it makes. If that tool has network or egress capability, the hidden payload leaves the environment without ever appearing in any visible text. The detection distinguishes strong signals (three or more literal Tag characters, or Tag control codes) that stand on their own, from weak signals (one or two stray characters, or only escaped references) which are only flagged when the agent's recent activity also shows a matching ingress or egress step, like fetching from a public host or connecting out.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- b7e4c1a2-9f3d-4e6b-8c05-2d71f4a9e83c
- Severity
- Medium
Why it matters
An organisation could have sensitive data silently exfiltrated from an AI agent's session, or have the agent covertly steered by injected instructions that no human reviewer would ever see in logs or transcripts.
What you can do
- →Restrict which tools an agent may call after ingesting untrusted external content, especially tools capable of outbound network requests.
- →Log and inspect raw tool-call payloads, not just rendered text, so invisible Unicode ranges are not missed during review.
- →Strip or reject Unicode Tag-block codepoints (U+E0000-U+E007F) from ingested content before it reaches an agent, except where legitimately part of a subdivision flag emoji.
- →Treat any agent behaviour that ingests public/untrusted content and shortly afterward makes an outbound or egress-capable tool call as worth reviewing.
Known benign look-alikes
- Subdivision flag emoji (e.g. the Scotland or Texas flag) are legitimate Tag sequences. The script deletes every U+1F3F4-anchored, U+E007F-terminated tag sequence before counting, so a message full of regional flags scores zero.
- Security research notes, CTF write-ups and Unicode conformance fixtures quote the escaped forms (\uDB40\uDC41, 󠁁, %F3%A0%81%81). Escaped forms alone need at least three occurrences AND graph corroboration before the rule reports.
- A single Tag character pasted in from copied web content or a mis-normalised clipboard round-trip. One or two residual characters with no Tag control codepoint are treated as a weak signal and need corroboration.
- Tokeniser, normaliser or font-tooling work that deliberately enumerates the Tag plane. These runs are strong-signal and will report; suppress by rule id for the specific engineering agent rather than by widening the pattern.