Unicode/Encoding Bypass
Use Unicode homoglyphs, invisible characters, or encoding tricks to bypass input filters and inject instructions
Tactic
Initial Access (Stage 2)
Gain control over agent behavior through prompt manipulation or input exploitation
Attack Class
UNICODE-STEGO
Using invisible Unicode characters, homoglyphs, and encoding tricks to bypass filters
Evidence
Confirmed in real-world production systems or internet-wide exposure assessments.
DVAA Validation
Reproductions in Damn Vulnerable AI Agent, the OpenA2A intentionally-broken agent for kill-chain validation.
token-smuggling-unicode
Honeypot Coverage (AgentPwn)
An AgentPwn trap page produces a payload tagged with this technique class. Following the AgentPwn taxonomy of trap pages shows what an agent encounters.
Higher tiers include zero-width Unicode and base64 payloads.
Evidence Source Breakdown
Evidence Timeline
HMA check UNICODE-STEGO-001 failed on damn-vulnerable-ai-agent
HMA check UNICODE-STEGO-001 failed on langserve
HMA check UNICODE-STEGO-001 failed on jamubc/gemini-mcp-tool
HMA check UNICODE-STEGO-001 failed on API-200/api200
HMA check UNICODE-STEGO-001 failed on saidsurucu/borsa-mcp
Detection (HackMyAgent)
npx hackmyagent secure --ciLive = check implemented in hackmyagent; queued = declared, not yet implementedDefense (OASB Controls)
How to Cite
AI Agent Threat Matrix T-2006 (Unicode/Encoding Bypass). OpenA2A, 2026. https://threats.opena2a.org/techniques/T-2006