Disclosed vulnerability
Scary Agent Skills: invisible Unicode Tag instructions hidden inside Agent Skills
AIR-2026-0037 AIR record · 2026-02-agent-skills-hidden-unicode
From the supporting source
A cautious user might review the text of a skill carefully, but with invisible Unicode Tags as instructions, even that will not help.embracethered.com
The record
Disclosed
2026-02-11
Vendor
multiple
Product
Agent Skills across Claude Code, OpenAI Codex, Gemini, GitHub Copilot
Risk domain
Access control and permissions › Privilege escalation
Also touches
Supply chain vulnerabilities, Data exfiltration channels
System type
Generative model
Who acted
Agent acted — the agent loaded and executed the invisible Unicode skill instructions
Attack surface
Skill / plugin
Autonomy level
Semi-autonomous
Initial vector
Malicious skill package
Impact type
Remote code execution, Data exfiltration, Supply chain compromise
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
anyone installing third-party Agent Skills
Capability abused
Defense & remediation
Recorded defense
human review of skill markdown
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
partial - Claude Code showed invisible-Unicode detection as of February 10, 2026; mitigations absent in claude.ai Skills
Taxonomy & references
Curator notes
Johann Rehberger. Skills are an open cross-vendor standard, so the exposure is ecosystem-wide.
Supporting sources
Cite as
Enkrypt AI. "Scary Agent Skills: invisible Unicode Tag instructions hidden inside Agent Skills". AIR, AIR-2026-0037. https://agentincident.vercel.app/i/AIR-2026-0037/ (accessed 2026-10-19).