Skip to content
Daniel TorresConnect

Case study 08 · Unicode security inspector for text and AI agents

GlyphSentry

Reveal what shouldn’t be hidden.

v1.0.0 build · 295 automated tests

Film uses GlyphSentry’s built-in four-layer example payload.

01Program challenge

Text can carry instructions a person cannot see: zero-width characters, tag characters, bidirectional overrides, lookalike letters and layered encodings. An AI model reads them. A reviewer does not.

As AI agents read web pages, documents and tool manifests, hidden text becomes a path for prompt injection through ordinary-looking content.

02Leadership decision

Requirements
Defined a phased scope: text inspection, decoding, the decode pipeline, config mode, spoofing detection, reporting and the command line.
Stakeholders
Security teams, AI agent builders and anyone passing untrusted text to a model.
Trade-off
Deferred watermark removal and file-metadata modules to keep the first release focused on what character analysis can prove.

Key decisions

No AI inside the product

Detection is static analysis only, with no model calls, so results are deterministic and there is no data exposure.

Local by design

Text never leaves the machine, and a content security policy blocks network connections.

Reviewable engineering

Built in six phases, each kept as its own branch, gated by 295 tests and 35 fixtures that reproduce byte for byte.

Honest about limits

Statistical watermarking cannot be detected by character filtering, and the tool says so instead of claiming it.

03Engineering solution

  • Text mode for prose and config mode for MCP manifests and skill files, where each field is parsed and scanned on its own.
  • A multi-layer decode pipeline that peels base64, hex, URL and HTML entity encodings until nothing new is found.
  • Confusable and mixed-script detection built on Unicode 17 data.
  • Verdict policies, three sanitize levels, and reports for tickets and pull requests, plus a command-line tool.
  1. Step 1

    Paste text or a tool manifest

  2. Step 2

    Read the verdict and the layer count

  3. Step 3

    See what the hidden text decodes to

  4. Step 4

    Sanitize and copy the clean text

04Operational impact

A sentence that looks harmless is shown carrying 832 hidden codepoints and an instruction to output the system prompt, then cleaned.

Positioned as a product at glyphsentry.com, with a command-line tool for pipelines and a site with a rule reference.