Counterfeiters have a long history with invisible ink. Not to hide money, but to mark it — a signature that passes under the eye of a clerk and only shows up under the right lamp. The trick works because human perception and machine verification look at different things. ASCII smuggling is the same idea, rebuilt for text: characters that render as nothing to a human reader but arrive fully intact at whatever parser is downstream. And according to Microsoft, spammers started reaching for it in volume beginning February 2026.
What makes this migration interesting to me is not the technique. It is old, conceptually simple, and involves a block of Unicode that most people never think about. What is interesting is the direction of travel. This started as an attack on AI systems — a way to smuggle instructions into a model’s context that a human reviewer would never see in the rendered text. Now it is showing up in ordinary phishing and spam, aimed at classifiers rather than language models. The finding surfaced out of Microsoft Defender for Office 365 research on prompt injection protection, which is a detail worth sitting with: the AI-security team found the traditional-security problem.
Two parsers, one string
The structural bug here has nothing to do with AI specifically. It is what happens when a single byte sequence is read by two systems with different notions of what counts as content.
A mail client renders text for a person. It respects zero-width characters, variation selectors, and other invisible code points by, essentially, doing nothing with them. A filter reads the same string as a token stream to score against known patterns. Insert invisible code points between the letters of a suspicious word and the two readers diverge. The human sees a clean sentence. The filter sees a token it has no signal for. Nobody has been hacked in the classical sense. The two consumers simply disagreed about what the message said, and the attacker chose which one to lie to.
This is the same failure mode that makes prompt injection so hard to close out in agent architectures. When you build a pipeline where content is displayed to a user, summarized by a model, logged for audit, and matched against policy, you have created four readers of one string. Every point where their interpretations differ is a place to hide something.
Why the crossover matters more than the tactic
I would argue the useful lesson from Microsoft’s telemetry is not “watch for zero-width characters.” That is a detection rule, and detection rules get written. The lesson is that techniques developed against AI systems transfer cleanly into non-AI systems, and they transfer fast.
The reason is that both target classes share an assumption. Prompt injection works because a model treats retrieved text as instruction-bearing. Filter evasion works because a classifier treats rendered text and raw text as equivalent. Both are assumptions about the trustworthiness and canonicality of input. Once attackers have built tooling and intuition for exploiting one, pointing it at the other costs almost nothing.
For anyone designing agent systems, that cuts the other way too. Techniques currently only used against email filters will find their way to your model context. If the toolchain is already there, expect reuse in both directions.
What normalization actually buys you
The mitigation is not exotic. Canonicalize input before any security decision touches it, and do it once, in one place, so every downstream reader sees the same string.
- Strip or explicitly flag invisible code points at ingest rather than at each consumer
- Make the normalized form the version that gets classified, logged, and fed to models
- Treat a large gap between rendered length and raw length as a signal in its own right
- Log the raw input separately for forensics, but never score against it
The part teams get wrong is the “one place” requirement. Normalization applied inconsistently across a pipeline recreates the original problem in a new location. If your filter normalizes and your model context does not, you have moved the divergence rather than removed it.
The uncomfortable part
Unicode is not going to get smaller. It exists to represent every writing system humans use, which means it will always contain code points that do not render, code points that render identically to others, and code points whose behavior depends on context. Any security architecture that assumes a one-to-one mapping between what a person reads and what a machine parses is building on a foundation that was never designed to provide that guarantee.
Spammers picking up a prompt injection tactic is a small story. The pattern underneath it — evasion techniques moving freely between AI and non-AI targets because they exploit the same class of assumption — is the one I would be planning around.
đź•’ Published: