Regional-Indicator Flag-Emoji Letter Spelling - ATR-2026-02018 (575a0c26-bdf5-5312-90a0-02108f5eaa52)
Detects prompt injection payloads obfuscated by spelling words one Unicode regional-indicator symbol per letter (the flag-emoji alphabet used in the U+1F1E6-U+1F1FF block). This is a known Discord/Twitter-culture obfuscation convention: each regional-indicator symbol renders as part of a flag emoji when paired, but a long unpaired run instead spells out Latin letters glyph-by-glyph (e.g. regional-indicator I + H + A + V + E ... spells "I HAVE BEEN..."), smuggling instructions past text-based filters that only inspect plain ASCII/Latin characters. Runs of 4+ consecutive regional-indicator symbols are anomalous in benign chat/content (legitimate flag emoji use at most 2 consecutive regional-indicator symbols to render a single country flag).