T-2006observedactive
Unicode/Encoding Bypass
Use Unicode homoglyphs, invisible characters, or encoding tricks to bypass input filters and inject instructions
Tactic
Initial Access (Stage 2)
Gain control over agent behavior through prompt manipulation or input exploitation
Attack Class
UNICODE-STEGO
Using invisible Unicode characters, homoglyphs, and encoding tricks to bypass filters
Evidence
observed
Confirmed in real-world production systems or internet-wide exposure assessments.
DVAA Validation
token-smuggling-unicode
Honeypot Coverage (AgentPwn)
An AgentPwn trap page produces a payload tagged with this technique class. Following the AgentPwn taxonomy of trap pages shows what an agent encounters.
Higher tiers include zero-width Unicode and base64 payloads.
Detection (HackMyAgent)
Live5 live · 0 queued
UNICODE-STEGO-001UNICODE-STEGO-002UNICODE-STEGO-003UNICODE-STEGO-004UNICODE-STEGO-005
npx hackmyagent secure --ciLive = check implemented in hackmyagent; queued = declared, not yet implementedDefense (OASB Controls)
Live5 live · 0 queued
How to Cite
AI Agent Threat Matrix T-2006 (Unicode/Encoding Bypass). OpenA2A, 2026. https://threats.opena2a.org/techniques/T-2006