Suspicious Unicode In AI Prompt
Updated: August 11, 2026
Description
Suspicious Unicode characters were detected in an AI prompt.
Invisible or unusual Unicode characters - such as Unicode tag characters, zero-width characters or homoglyphs - are used in ASCII smuggling attacks to embed hidden instructions in text. Content that looks harmless to a human reviewer can carry concealed prompt injection payloads that the AI model parses and follows.
Example Attack
An attacker publishes a job description containing instructions hidden in invisible Unicode tag characters. An employee copies the text into an AI assistant to summarise it, and the hidden payload instructs the assistant to exfiltrate the conversation history to an attacker-controlled URL - all invisible to the employee reading the text.
Remediation
Review the flagged prompts to determine the source of the suspicious characters. If the content was pasted from an external source, treat that source as potentially malicious. Configure guardrails to strip or block invisible Unicode characters in prompts before they reach AI services.
Security Frameworks
A Prompt Injection Vulnerability occurs when user prompts alter the LLM's behavior or output in unintended ways. These inputs can affect the model even if they are imperceptible to humans, therefore prompt injections do not need to be human-visible/readable, as long as the content is parsed by the model.
An adversary may craft malicious prompts as inputs to an LLM that cause the LLM to act in unintended ways. These prompt injections are often designed to cause the model to ignore aspects of its original instructions and follow the adversary's instructions instead.
Inputs that could steer model behavior must be normalized, screened by a prompt injection detection ruleset or classifier, and subordinated to a system-level instruction hierarchy.
Automated classifiers must scan every response and block harmful content, system prompt disclosure, outbound request triggers, and hidden or encoded content.
Known jailbreak patterns, prompt injection attempts, adversarial inputs, probing behavior, and granular token usage must be detected, attributed, and alerted on.