Zero-Width Character Attacks: How Hidden Unicode Is Used to Hijack AI Agents

There is a class of attack so subtle that it passes every visual inspection — yet it can turn a seemingly harmless AI skill into a tool that steals your credentials, exfiltrates files, or executes arbitrary shell commands.

The weapon: zero-width characters.

What Are Zero-Width Characters?

Zero-width characters are Unicode code points that render as nothing — no visible glyph, no space, no cursor movement. They were originally designed for typographic control in scripts like Arabic and Hebrew, but they have become a powerful tool for attackers targeting AI systems.

The most commonly abused characters:

Open any text editor and paste one of these characters. You won't see a thing — but AI language models process them as real tokens.

How the Attack Works

Step 1: The Attacker Crafts a Poisoned Skill

Consider a skill that appears to be a simple code formatter:

Visually, this looks completely safe. But embedded within that text — between the letters, invisible to any human reader — are hundreds of zero-width characters that spell out a second instruction set:

The human sees: "You are a helpful code formatter."
The AI reads: "You are a helpful code formatter. [hidden malicious instruction]"

Step 2: The Agent Executes the Hidden Command

When a user installs this skill and asks the agent to format their code, the agent simultaneously receives the hidden instruction. Depending on the agent's capabilities (file access, network access), it may silently read SSH keys, environment variables, or other sensitive files and transmit them to the attacker's server.

The user sees normal code formatting output. The attack is completely invisible.

Step 3: Detection Is Non-Trivial

A developer reviewing this skill in VS Code, Vim, or any standard editor will see nothing unusual. Even copying the text to a plain-text field and reading it back looks clean.

You need specialized tooling to detect these characters.

Real-World Attack Scenarios

Scenario 1: ClawHub Skill Poisoning

An attacker publishes a "Python Linter" skill on ClawHub with 5-star reviews (purchased). The skill description and README look professional. Hidden in the system_prompt are zero-width encoded instructions to exfiltrate ~/.aws/credentials whenever the agent has file access.

Scenario 2: Supply Chain Attack via Forked Skill

A legitimate, well-reviewed skill is forked on GitHub. The attacker adds zero-width characters to the system_prompt in a commit described as "fix typo in instructions." The diff shows no visible changes — most code review tools won't display zero-width characters.

Scenario 3: MCP Config Poisoning

Zero-width characters can also appear in MCP configuration files. An attacker tricks a user into copying a "sample config" from a blog post or forum. The config looks correct but contains hidden instructions that redirect all skill scan results to return false negatives.

How to Detect Zero-Width Character Attacks

Method 1: SkillsSafe Detector (Recommended)

Visit skillssafe.com/en/zero-width-detector and paste the skill content. The tool will:

• Instantly identify all zero-width characters
• Show their exact positions in the text
• Display the decoded hidden content
• Highlight suspicious character clusters

No installation required. Free, no signup.

Method 2: Command Line

# Check for zero-width characters in a file
cat -v SKILL.md | grep -P '[\x{200B}-\x{200F}\x{FEFF}\x{2060}-\x{2064}]'

# Count occurrences
python3 -c "
import sys
text = open('SKILL.md').read()
zwc = [c for c in text if ord(c) in [0x200B,0x200C,0x200D,0xFEFF,0x2060]]
print(f'Found {len(zwc)} zero-width characters')
"

Method 3: SkillsSafe Full Scanner

Run the full skill through skillssafe.com to catch zero-width characters alongside all other threat categories (credential theft, data exfiltration, shell injection, etc.) in a single scan.

curl -X POST https://skillssafe.com/api/v1/scan/url \
  -H "Content-Type: application/json" \
  -d '{"url": "https://clawhub.ai/skills/my-skill/SKILL.md"}'

The response includes a zero_width finding category with character positions and decoded content.

Why This Attack Is Particularly Dangerous for AI

Traditional software ignores zero-width characters — they don't affect program logic. But AI language models are different:

1. LLMs process all Unicode tokens — zero-width characters are valid tokens that the model reads and acts on
2. Context window poisoning — the hidden text becomes part of the model's context, influencing all subsequent reasoning
3. No visual audit trail — unlike shell injection or SQL injection, there is nothing to see
4. Bypasses most security tools — static analysis tools designed for code won't flag Unicode manipulation in natural language text

Defenses

For Skill Consumers

1. Always scan before installing — use SkillsSafe for every skill from any source
2. Run the zero-width detector on any skill content you can't fully verify
3. Check git diffs carefully — use git diff --word-diff and look for suspicious Unicode in commit diffs
4. Prefer skills from verified publishers with public audit histories

For Skill Developers

1. Normalize your text — strip zero-width characters from all system_prompt content before publishing
2. Add a CI check:

# In your CI pipeline
python3 -c "
import sys, re
text = open('SKILL.md').read()
if re.search(r'[\u200b-\u200f\ufeff\u2060-\u2064]', text):
    print('ERROR: Zero-width characters detected in SKILL.md')
    sys.exit(1)
print('OK: No zero-width characters found')
"

1. Sign your releases — use GPG signing on git tags so users can verify the skill hasn't been tampered with

The Bigger Picture: Unicode as an Attack Surface

Zero-width characters are just one category of Unicode-based attacks. The same principle applies to:

• Homoglyph attacks — replacing Latin letters with visually identical Cyrillic or Greek characters (e.g., "а" U+0430 instead of "a" U+0061)
• Bidirectional text attacks — using RTL override characters to visually reverse text in code review UIs
• Tag characters — U+E0000 block characters, sometimes used in more sophisticated encoding schemes

As AI agents gain more capabilities — file access, network access, code execution — the impact of successful prompt injection via hidden Unicode grows correspondingly.

Summary

Zero-width character attacks are:

• Invisible to human reviewers using any standard tool
• Effective against current AI language models
• Trivial to deploy — any Unicode-aware text editor can insert them
• Detectable with the right tools, including SkillsSafe

Before installing any AI agent skill, run it through a zero-width character detector. The scan takes less than 10 seconds and could prevent a complete credential compromise.

Published by SkillsSafe — Free AI agent skill security scanner. Supports OpenClaw, Claude Code, Cursor, and Codex.