The example finding given in the original was that an attacker used the Arabic ي to bypass the input filter, succeeding seven times out of ten attempts, with the model leaking the system prompt but not calling tools, rated medium severity; the root cause was that the filter compared raw text directly with no normalization at the boundary; after the fix, the same ten attempts yielded zero successes.