You’re at your desk on a Tuesday morning, coffee going cold, working through an inbox that filled up overnight. One message looks like a normal invoice reminder. Nothing about it feels off. The subject line reads clean. The body text is short and plain. Your email filter let it through without a second thought.
What you can’t see is that the message is carrying passengers. Tucked between the visible letters are characters that render as absolutely nothing on your screen — no space, no dot, no glyph. To your eyes, the email says one thing. To software reading the underlying data, it says something else entirely.
This is ASCII smuggling, and it just changed jobs.
What the technique actually does
Unicode is the standard that lets computers represent text from nearly every writing system on earth. It’s enormous, and tucked inside it are blocks of characters that don’t display anything visible. They were included for technical reasons, and for years almost nobody paid attention to them.
ASCII smuggling uses those invisible characters to hide content in plain sight. The hidden text is fully present in the file or message. Machines process it. Humans never see it. That gap between what a person perceives and what a system reads is the whole trick.
If you’ve followed AI security news at all, you’ve probably run into this idea already, even if the name didn’t stick. It’s been one of the more popular methods for attacking AI systems through prompt injection — sneaking instructions into text that a model will obey while the person reviewing that text sees nothing unusual.
Why spammers wanted it
Now the technique has crossed over. Microsoft has observed a sharp increase in ASCII smuggling being used in phishing campaigns, where the goal isn’t manipulating an AI model but slipping past email filters.
The logic is straightforward once you see it. Email security tools work largely by pattern matching. They scan for suspicious words, known malicious phrases, and structures that look like past attacks. Break up a flagged phrase with invisible characters and the pattern no longer matches, while the message still reads perfectly to the person opening it. The filter sees gibberish it doesn’t recognize. You see a normal sentence.
What makes this notable is where the discovery came from. According to Microsoft, the finding emerged out of research into prompt injection protection in Microsoft Defender for Office 365. Work aimed at protecting AI systems surfaced a threat aimed at ordinary email. Two problems that looked separate turned out to share the same underlying weakness.
The pattern worth paying attention to
I write about AI agents for people who don’t build them, and this story captures something I keep coming back to. Attack techniques don’t stay in their lane.
ASCII smuggling was, for a stretch, mostly an AI problem. It showed up in demos of prompt injection, in security research about model manipulation, in conversations about whether you can trust what an AI agent reads. Then someone realized the same characters that fool a language model also fool a spam filter. The technique moved sideways into a much older category of attack.
This cuts both ways, which is the part I find genuinely useful. Traditional attack methods get repurposed against AI systems. AI-era methods get repurposed against traditional systems. The same set of tools circulates through both worlds, and defenders who treat AI security and email security as unrelated disciplines will keep missing things that sit in the overlap.
What this means if you’re not in security
A few practical takeaways for regular people using AI tools and email every day:
- What you see on screen isn’t always the complete content. Text can carry data that renders invisibly to humans but processes normally for software.
- Filters are pattern-based, which means they’re beatable by anyone willing to break the pattern in a way humans don’t notice.
- If you use AI agents that read documents, emails, or web pages on your behalf, they’re reading the invisible parts too. Their reading of a page can differ from yours.
- The usual advice still holds. Be careful with unexpected attachments and links, regardless of how legitimate a message looks.
None of this requires you to become a security expert. It just asks you to hold a slightly looser grip on the assumption that a screen shows you everything.
The takeaway
ASCII smuggling started as a way to trick machines that read language. Now it’s a way to trick machines that filter mail. The characters didn’t change. Only the target did.
Defenders are aware of it, and Microsoft’s telemetry means the technique is being tracked rather than quietly spreading. But this crossover is a reminder that the line between AI security and regular security is thinner than it looks. When a trick works on one kind of text-reading system, it tends to find its way to the others.
🕒 Published: