Unicode Obfuscation

Unicode obfuscation is a technique where attackers hide malicious instructions inside text using invisible or look-alike characters, so that a person reviewing the content sees something harmless while an AI system or software reads something different. For AI governance, this matters because it can let someone slip hidden commands into prompts, documents, or code that an AI tool then follows without the user noticing. Compliance and risk teams should treat AI tools that process untrusted text as needing input filtering and review, not just a visual check by staff.

1 item

ResearchGlobal2026-11-02

Live Invoice Fraud Campaign Hides Commands That Hijack Email AI Agents

Security vendor Sublime Security documented an active invoice fraud campaign embedding hidden instructions inside emails using invisible Unicode characters. The technique targets AI agents that read and act on email, redirecting them to follow attacker commands instead of legitimate user instructions. Enterprises running AI-connected email workflows face immediate prompt injection and financial fraud risk.

prompt injection invoice fraud email agents agentic AI Sublime Security financial controls Unicode obfuscation