Unicode formatting characters that change the displayed direction of text without changing the underlying byte sequence. Attackers use them to make code or prompts look different from how they are logically processed, which can mislead reviewers and allow malicious content to pass inspection.
What Bidirectional Control Characters Are
Bidirectional control characters are Unicode formatting marks that can alter how text is displayed without changing the underlying sequence of bytes. That split between logical text and rendered text matters because a reviewer may see one ordering, while a compiler, parser, prompt processor, or other downstream tool interprets another.
They are not ordinary content characters. Their purpose is to influence text direction, which is useful in legitimate multilingual rendering, but dangerous when the display layer is used to hide or rearrange code, comments, identifiers, or instructions.
Why They Are Security-Relevant
The core security issue is visual deception. An attacker can place a directional override or isolate character so that a line appears safe, harmless, or syntactically different from how it is actually processed. That can mislead code review, prompt review, logging review, or other human inspection steps that rely on what the text appears to say.
This is especially risky anywhere text is manually reviewed before execution or ingestion. Source code, configuration files, prompt templates, policy text, and documentation can all be affected when an examiner trusts the rendered view instead of inspecting the underlying bytes or code points.
How They Are Used in Attacks
In malicious use, the character sequence is crafted to create a mismatch between appearance and behaviour. The text may display in a way that moves a hidden fragment into a comment, swaps the apparent order of tokens, or makes a dangerous string look like a benign one.
The attack is usually low-noise and premeditated. It does not depend on breaking cryptography or bypassing authentication, it depends on exploiting the gap between human perception and machine parsing. That makes the technique attractive for supply-chain abuse, review evasion, and malicious content insertion where trust is built on visual inspection.
How to Reduce Exposure
Defence starts with visibility into the actual characters present, not just the rendered output. Security teams should use tooling that reveals Unicode code points, flags directional formatting marks, and normalises inspection workflows so reviewers can see suspicious text before approval or execution.
Controls should be applied where untrusted text enters development or operational pipelines, including commit hooks, code review systems, document ingestion, prompt handling, and security scanning. Broad control baselines such as NIST SP 800-53 Rev 5 Security and Privacy Controls and CIS Benchmarks support the broader practices of system integrity, configuration discipline, and review hardening that help reduce this class of issue.
Risk and Threat Considerations
Bidi control characters are a review-evasion technique. They can hide malicious payloads inside text that appears innocuous, creating a mismatch between what a person approves and what a system actually executes or ingests.
Failure mechanism: The attacker inserts directional formatting marks so the displayed order of text differs from the logical order, defeating visual inspection and making malicious content harder to notice.
Impact: Reviewers may approve unsafe code, prompts, or configuration, enabling hidden malicious logic, policy bypass, or downstream compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-7 — Software, Firmware, and Information Integrity | Integrity controls help detect deceptive text that can alter what reviewers think they approved. |
| CM-7 — Least Functionality | Limiting accepted characters and formatting reduces abuse of hidden text-control characters. | |
| Recommendation — Validate untrusted text inputs and flag suspicious Unicode formatting before code or prompt approval. Restrict allowed Unicode control characters in review and ingestion paths. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | Secure review and validation of application content helps catch malicious text that exploits display ambiguity. |
| Recommendation — Scan source and configuration inputs for control characters before merge or deployment. | ||
| OWASP ASVS | V1 — Encoding and Sanitization | Unicode control characters are an input-handling and sanitization concern when text reaches apps or prompts. |
| Recommendation — Sanitize or reject bidirectional formatting marks where they are not explicitly required. | ||
| MITRE ATT&CK | T1027 — Obfuscated Files or Information | Bidirectional controls are a form of text obfuscation used to hide malicious content from inspection. |
| Recommendation — Hunt for suspicious Unicode obfuscation in code, documents, and payloads. | ||
Practitioner Guidance
What to watch for: Treat unexplained direction changes, odd character ordering, and inconsistent rendering as inspection failures, not mere formatting quirks. When suspicious text is found, review the raw bytes or code points before accepting the content.
Governance implication: Organisations should define where Unicode control characters are allowed, how they are surfaced in review tooling, and which pipelines must reject or strip them. If the content is legitimate multilingual text, the policy should still force explicit handling rather than silent acceptance.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 5, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org