Unicode Variant Selector ASCII Smuggling in Tool Response
Attackers can hide secret instructions inside text that looks completely normal by encoding each hidden character as an invisible Unicode 'variation selector' attached to a visible letter or emoji. A human reading the tool's response sees nothing unusual, but an AI model processing the same text reads the hidden bytes and can be manipulated into following injected instructions.
How the attack works
An attacker plants a tool response (a webpage, document, API result, etc.) containing an ordinary-looking character followed by a long run of invisible Unicode variation selector codepoints. Each selector encodes one byte of a hidden ASCII message, so a chain of them spells out full instructions invisibly. Legitimate text never chains more than one variation selector after a character, so a run of three or more is a technical impossibility for normal typography. When an AI agent reads the tool response, it processes the hidden text along with the visible content, allowing the smuggled instructions to act as an indirect prompt injection.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7f3c9a21-4d68-4b0e-9c15-2a8f6b1d4e73
- Severity
- Medium
Why it matters
An organization's AI agent can be silently redirected by content it treats as trustworthy data (a fetched webpage, file, or API response), potentially leading to leaked data, unauthorized actions, or bypassed safety instructions, without any visible trace for a human reviewer.
What you can do
- →Strip or normalize Unicode variation selectors from tool/API responses before passing them to a model, unless the source is known to require them for legitimate emoji or CJK rendering.
- →Log and review tool responses containing runs of three or more consecutive variation selector codepoints (U+FE00-FE0F, U+E0100-E01EF).
- →Treat fetched external content (web pages, documents, third-party API results) as untrusted input and isolate it from instructions the model should trust.
- →When triaging alerts, distinguish real smuggling attempts from security research write-ups or Unicode conformance test data that may legitimately contain such sequences.
Known benign look-alikes
- Security research or awareness material that pastes a live smuggling sample alongside its explanation (suppressed by filter_security_writeup and filter_escaped_codepoint_notation).
- Unicode conformance / IVD test corpora fetched by a documentation or localisation tool, where variation sequences appear en masse with explicit conformance wording (suppressed by filter_unicode_conformance_data).
- Font-rendering or shaping regression fixtures deliberately containing invalid consecutive-selector sequences to exercise a shaper's error path. Rare, and reported rather than blocked.
- Corrupted or double-encoded text (mojibake) from a legacy CJK source that collapses several selectors together. Reported for triage.