Skip to main content
Ona validates prompts for deceptive Unicode characters before sending them to the agent. When detected, the characters are automatically replaced with their intended equivalents and a warning is shown. This protects against homograph attacks where visually identical characters from different scripts are used to disguise instructions.

What gets detected

Confusable characters (homoglyphs) Characters from one script that look identical to characters from another. For example, Cyrillic ‘а’ (U+0430) looks identical to Latin ‘a’ (U+0061) but has a different code point. An attacker could write “pаypal.com” using a Cyrillic ‘а’ to make a malicious instruction look legitimate. Detection uses the Unicode confusables database. A character is flagged only when it appears in a word that mixes scripts. A fully Cyrillic word in a Russian sentence is not flagged. Bidirectional override characters Invisible Unicode control characters (U+202A through U+2069) that change text rendering direction. These enable Trojan Source attacks where displayed text differs from the actual content.

What happens when deceptive characters are found

  1. The prompt text is automatically corrected:
    • Confusable characters are replaced with their Latin equivalents (e.g., Cyrillic ‘а’ → Latin ‘a’)
    • Bidirectional overrides are stripped
  2. A warning banner appears showing how many characters were removed
  3. You can click Undo to restore the original text if the correction was wrong
The prompt is not sent to the agent until you either accept the corrected text or undo and resubmit.

Allowed script combinations

Some languages naturally mix scripts. These combinations are not flagged:
CombinationReason
Han + Hiragana + KatakanaJapanese text
Han + HangulKorean text with Hanja
Han + BopomofoChinese phonetic annotation
Han + LatinTechnical/international contexts (Han has no Latin lookalikes)

Limitations

  • Detection is per-word. A confusable character in an isolated word (not mixed with another script) is not flagged.
  • Only characters with entries in the Unicode confusables database are detected.
  • The feature validates prompt text only, not file contents or tool outputs.