Cairn

ZWJ emoji falsely flagged as prompt injection threat

NousResearch/hermes-agent · cluster 18581 · agent

Data as of

5 open items. Fix attempted, not merged.

The short answer

1open issue
4open PRs
12items grouped
Known?
Yes. 12 related items grouped here, 1 issue already closed.
Fix event
No fix has been merged to main. 6 PRs closed without merging; see the attempts below.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
1 issue and 4 PRs.

A threat/injection scanner incorrectly flags Zero Width Joiner (U+200D) characters in context files, causing legitimate emoji sequences and files like SOUL.md to be dropped. Multiple fixes attempt to exempt ZWJ within valid emoji grapheme clusters from the invisible-unicode detection rule, with at least one related change to surface scanner block warnings to users.

Open issues1

  • Issue#59492False positive: ZWJ emoji (U+200D) in context files (SOUL.md/AGENTS.md) is flagged as injection and drops the whole file

Open PRs4

  • PR#59503fix(security): skip ZWJ in legitimate emoji sequences during injection scan
  • PR#59622fix(agent): surface threat-scanner block warnings to users
  • PR#59652fix(prompt-builder): surface threat-scanner context blocks to the user
  • PR#59668fix(agent): preserve ZWJ (U+200D) in context files (#59492)

6 PRs closed without merging

From the close comments: duplicate 4 · other 2

  • #12673 fix: allow ZWJ inside emoji grapheme clusters in context/memory/skills scanners · other
  • #18644 fix: remove ZWJ from invisible char blocklist to allow compound emoji in context files · duplicate → #18616
  • #35808 fix: allow ZWJ (U+200D) in legitimate emoji sequences · other
  • #59701 fix(agent): allow ZWJ emoji sequences in threat scanner (#59492) · duplicate → #59503, #12673, #59492
  • #59710 fix(threat_patterns): stop flagging legitimate ZWJ emoji as invisible-unicode injection · duplicate → #59503, #59492, #12673
Show 1 more
  • #59925 fix(threat-scanner): exempt ZWJ emoji sequences from invisible unicode flag (#59492) · duplicate → #59503, #59492, #59701, #59668, #59710, #59923
Closed issues · 1
  • Closed#18581🤸‍♀️ SOUL.md blocked by ZWJ emoji — cartwheel gymnast triggers prompt injection filter
How this cluster was grouped
  • Link evidence (partly structural links): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
  • Members outside that structural core may belong to a different underlying problem.
  • Pairwise link density 0.16: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent
Closed issues
1
Attempts
6 PRs closed without merging

For your agent

The same facts, typed.

cluster/18581.json
cluster/18581.md