Steganographic Instruction Embedding

Adversary Behavior: An adversary embeds prompt injection payloads within project files, documentation, or AI configuration files using Unicode control characters that are invisible to human reviewers but processed by the LLM tokenizer.

AI/IDE Mechanism: LLM tokenizers process the full Unicode spectrum, including zero-width joiners (U+200D), zero-width spaces (U+200B), bidirectional text override characters (U+202E, U+202C), and other non-printing characters. Standard text editors, diff viewers, and code review interfaces do not render these characters, creating a gap between what the human reviewer sees and what the LLM processes.

Execution Path: The adversary encodes malicious instructions as sequences of invisible Unicode characters and inserts them into files that will be ingested by the LLM during context assembly. The LLM decodes these character sequences as valid instructions while the file appears benign in all standard review tools.

Security Impact: The injected instructions evade human review, automated linting, and standard code review processes, allowing adversary commands to persist undetected in repositories and influence LLM behavior whenever the containing files are included in context.