Find invisible Unicode characters hiding in text — zero-width spaces, joiners, BOMs, bidi controls, and Unicode "tag" characters (the same class used for prompt-injection steganography). Highlight them, count them, and strip them out.
Format controls: U+200B ZWSP, U+200C ZWNJ, U+200D ZWJ, U+2060 WORD JOINER, U+FEFF BOM / ZWNBSP.
Bidi overrides: U+202A–U+202E, U+2066–U+2069 — used in the 2021 "Trojan Source" attack.
Unicode tag block: U+E0000–U+E007F — invisible code points used to smuggle instructions into AI prompts.
Soft hyphen: U+00AD — breaks words but usually invisible.
Regular spaces and newlines are left alone; only characters that render as nothing are flagged.