A LinkedIn @mention looked ordinary. Its raw text carried 21 invisible code points: U+E0000, 19 Unicode Tag characters encoding “enter goal here __.”, then U+E007F.

That establishes a hidden text channel. It does not establish successful prompt injection, intent or authorship. Whether those characters reach a model depends on your extractor and downstream processing.

Here is the engineering response I recommend:

  1. Keep an original evidence copy. Inspect code points, not just rendered text.

  2. Detect anomalous tag runs. Remove or visibly escape them in the derived text used for AI ingestion. Avoid destroying valid emoji tag sequences. These are Unicode code points, not HTML tags. Unicode defines their legitimate emoji use.

  3. Keep external content explicitly separate from trusted instructions. A post, document or tool result is untrusted data. It cannot grant itself permission to rewrite the task.

  4. Enforce tool permissions, arguments and consequential-action checks outside the model. Give the reader only the access its task requires. OWASP describes these defensive layers.

NFKC normalization alone does not remove these characters.

And stripping them does not defeat semantic injection. A perfectly visible paragraph can still manipulate a summary, claim false authority or solicit an unauthorized action.

Your ingestion filter is one checkpoint. It is not mission control.