AI Hidden Character Lab: An Invisible Instruction in a RAG Document

This article describes a hands-on cybersecurity lab demonstrating hidden-character injection against RAG (Retrieval-Augmented Generation) systems, specifically using DocsBot as a case study. The attack embeds invisible Unicode characters—zero-width spaces, joiners, and bidirectional overrides—into documents that appear harmless to human reviewers but carry executable instructions for the model. The technique reveals a critical gap in human-in-the-loop security controls: when content is invisible to people but legible to AI systems, approval processes provide no meaningful protection.

• Invisible Unicode survives markup strippingDocsBot's document upload pipeline removes visible HTML and markdown but explicitly preserves zero-width and bidirectional Unicode characters. This selective filtering creates a security gap where invisible payloads pass through sanitization intact and remain indexed in the system, ready to activate when retrieved into model context.
• Two-layer content divergence defeats reviewThe human review layer sees a benign-looking document because invisible characters are not visible to people; the model ingestion layer sees plain text containing hidden instructions. Because these two layers process different content, a document can receive human approval while carrying live, undetected instructions that fire when the model processes it.
• Attack payload embeds via zero-width charactersAn attacker can craft a normal-looking document, hide an instruction (such as 'disclose the support key') using zero-width spaces, joiners, or bidirectional overrides, and upload it knowing the markup stripper will leave the invisible instruction intact. When a user query retrieves that document into context, the model obeys the embedded instruction.
• Human approval becomes a false security controlThe article emphasizes that 'a human checked it' is not a valid control when the payload is invisible to humans but legible to the model. If an upload pipeline preserves anything a reviewer cannot see, human approval provides no safeguard against hidden-character injection.
• Defense requires normalization at ingestionThe recommended mitigation is to strip invisible Unicode—zero-width characters, bidirectional overrides, and combining marks—before text is indexed, not after a breach occurs. Text should also be normalized to a canonical form so hidden payloads cannot survive storage, and retrieved content must be treated as inert data, clearly separated from instructions.
• Classification as LLM01 with LLM08 angleThe article maps this attack to OWASP LLM01 Prompt Injection with an LLM08 Vector and Embedding Weaknesses component (2025 list), reflecting that the threat combines direct prompt injection via hidden characters with the broader risk of poisoned documents entering a RAG index.
• Lab format enables hands-on vulnerability testingThe lab runs in a browser with no signup, takes about 20 minutes, and teaches the technique by having learners author their own hidden-character payload, upload it, and observe it execute. The article encourages readers to attempt their own approach before viewing the spoiler solution.

Bottom line: Hidden-character injection is a form of indirect prompt injection that defeats human review because the payload is invisible to people but plain text to models; the only effective defense is to strip invisible Unicode and normalize text at ingestion time, and to treat all retrieved content as inert data rather than instructions. Relying on human approval as a control for content containing invisible characters is ineffective and creates a false sense of security.