LmCast :: Stay tuned in

Microsoft says email spammers are adopting ASCII smuggling

Recorded: Sept. 9, 2026, 9 p.m.

Original Summarized

Once popular for attacking AI, ASCII smuggling is embraced by spammers - Ars Technica

Skip to content

Ars Technica home

Sections

Forum

Subscribe

Search

AI

Biz & IT

Cars

Culture

Gaming

Health

Policy

Science

Security

Space

Tech

Feature

Reviews

AI

Biz & IT

Cars

Culture

Gaming

Health

Policy

Science

Security

Space

Tech

Forum

Subscribe

Story text

Size

Small
Standard
Large

Width
*

Standard
Wide

Links

Standard
Orange

* Subscribers only
  Learn more

Pin to story

Theme

HyperLight

Day & Night

Dark

System

Search

Sign In

CAN YOU 󠁲󠁥󠁡󠁤SEE THIS?

Once popular for attacking AI, ASCII smuggling is embraced by spammers

A once-overlooked block of unicode that’s invisible to humans is gaining ever wider use.

Dan Goodin

–

Sep 4, 2026 1:18 pm

|

53

Eyeball with a digital line over it.


Credit:


Getty Images

Eyeball with a digital line over it.


Credit:


Getty Images

Text
settings

Story text

Size

Small
Standard
Large

Width
*

Standard
Wide

Links

Standard
Orange

* Subscribers only
  Learn more

Minimize to nav

A clever technique used to hide malicious prompts in attacks on AI agents has been adopted by spammers to evade filters on email platforms that are designed to flag unwanted messages used in mass campaigns.
The technique is broadly known as ASCII smuggling. It gained attention two years ago as a means of making a class of AI attack known as prompt injections more stealthy. Malicious instructions embedded in emails or other untrusted content to be processed by an LLM aren’t written in ordinary text. Instead, they’re rendered by a special range of Unicode tags. For example, the tag point U+E0041 mirrors “A,” and U+E0061 mirrors “a.”
No longer just for obscuring prompt injections
The block of 128 tags mimics a portion of the American Standard Code for Information Interchange almost perfectly, with one major difference: the characters they encode are readable by computers but, by design, are almost completely invisible to humans. By expressing the malicious prompts in these tags, LLMs detect the instructions, but people reading the email never see them. There’s much more about ASCII smuggling here.
Earlier this year, Microsoft started seeing a massive increase in spam messages that used the technique. Beginning on one day in early February, the number of ASCII smuggling signatures detected by Microsoft Defender for Office spiked from roughly 21,000 per day to more than 1.3 million. Within four days, signature detections jumped to 2.5 million. The deluge persisted for months and then fell off sharply in mid-May.
“Because tag characters are invisible to humans but exist at the text-processing level, the same property that makes them useful for smuggling instructions into a model also makes them useful for obfuscating keywords before a detector evaluates them,” Microsoft explained Thursday. “The intent is inverted, but the mechanism is similar, and a user’s suspicions are not raised.”

Daily hits on the ASCII smuggling signature, a week before and after onset.

Credit:
Microsoft

Daily hits on the ASCII smuggling signature, a week before and after onset.


Credit:


Microsoft

Daily Unicode-tag signature hits on finance-themed sender domains, log scale, measured every day from February 9 through June 18, 2026.

Credit:
Microsoft

Daily Unicode-tag signature hits on finance-themed sender domains, log scale, measured every day from February 9 through June 18, 2026.


Credit:


Microsoft

Spammers are embedding Unicode in an attempt to evade filters that search for text, such as dollar amounts and the words “credit” and “term” that are commonly found in their mass emails. By sprinkling the invisible text into the middle of the word “funding,” for example, filters may read the words “fun” and “ding” instead. The receiver, meanwhile, sees the word “funding.”

Credit:
Microsoft

Credit:


Microsoft

Using special text to camouflage certain trigger words isn’t new. Spammers have used zero-width spaces and non-breaking spaces for decades to achieve similar results. The characters can thwart searches matching a literal string and alter the byte sequence that regex filters hunt for. The spammers likely adopted the hidden Unicode tags because some spam filters had yet to be programmed to detect them. A bigger likely reason for its use is to counteract the advantages made possible by machine learning (ML) and natural language processing (NL) LLMs for use in spam detection.
Microsoft explained:
The bigger prize for the attacker, though, is not preventing the literal string matches; it is the ML- and NLP-based models that increasingly drive modern spam and phishing classification. Unless a filtering system takes a picture of a message and does OCR extraction over the visual image, it may miss this type of attack. A standard email classifier may not reason over whole words exactly as a human sees them; for efficiency, they can first split text into tokens or sub-word pieces. A clean lure term such as funding may be represented as a familiar token or a familiar sequence of sub-tokens. Insert an invisible U+E0020 into the middle, however, and the tokenizer may no longer see that same familiar unit. It might split the text into fun, an unexpected tag character, and ding; it might emit rare or unknown sub-tokens; or, if normalization runs first, it simply removes the U+E0020 character, leaving funding.
Thursday’s post provided guidance on ways developers can program filters to better account for ASCII smuggling in spam.

Dan Goodin

Senior Security Editor

Dan Goodin

Senior Security Editor

Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Dan is based in San Francisco. Follow him at here on Mastodon and here on Bluesky. Contact him on Signal at DanArs.82.

53 Comments

Staff Picks

m

marsilies

What was the intended use case for this character range?
A previous Ars artilce (linked to in this article) goes into more detail:
https://arstechnica.com/security/20...isible-text-creating-an-ideal-covert-channel/

Deprecated (twice) but not forgotten​The Unicode standard defines the binary code points for roughly 150,000 characters found in languages around the world. The standard has the capacity to define more than 1 million characters. Nestled in this vast repertoire is a block of 128 characters that parallel ASCII characters. This range is commonly known as the Tags block. In an early version of the Unicode standard, it was going to be used to create language tags such as “en” and “jp” to signal that a text was written in English or Japanese. All code points in this block were invisible by design. The characters were added to the standard, but the plan to use them to indicate a language was later dropped.

With the character block sitting unused, a later Unicode version planned to reuse the abandoned characters to represent countries. For instance, “us” or “jp” might represent the United States and Japan. These tags could then be appended to a generic 🏴flag emoji to automatically convert it to the official US🇺🇲 or Japanese🇯🇵 flags. That plan ultimately foundered as well. Once again, the 128-character block was unceremoniously retired.

Riley Goodside, an independent researcher and prompt engineer at Scale AI, is widely acknowledged as the person who discovered that when not accompanied by a 🏴, the tags don’t display at all in most user interfaces but can still be understood as text by some LLMs.
It's interesting that the Ars article calls the flag modifier function essentially "depreciated," when there's this comment:

Officially they are deprecated for use as a language specifier. They've been repurpose as a modifier for flag emojis so more regions can have flags. 🏴gbwls✦ would produce the Wales flag.

This is pretty rare though and not well supported.
And Wikipedia:
https://en.wikipedia.org/wiki/Tags_(Unicode_block)
With the release of Unicode 9.0, U+E007F is no longer a deprecated character. (U+E0001 LANGUAGE TAG remains deprecated.) The release of Emoji 5.0 in May 2017 considers these characters to be emoji for use as modifiers in special sequences.

The only usage specified is for representing the flags of regions, alongside the use of Regional Indicator Symbols for national flags.

The tag sequences are derived from ISO 3166-2, but sequences representing other subnational flags (for example US states) are also possible using this mechanism. However, as of Unicode version 12.0 only the three flag sequences listed above are "Recommended for General Interchange" by the Unicode Consortium, meaning they are "most likely to be widely supported across multiple platforms"
Suggesting the flag modifier function isn't so much "depreciated" as "not widely implemented."

September 4, 2026 at 6:52 pm

Comments

Forum view

Loading comments...

Prev story

Next story

Most Read

1.
LG TV shown scanning LAN for third-party phones and other devices

2.
Man told ChatGPT he was feeling delusional. ChatGPT insisted he was Jesus.

3.
Why this month's Microsoft patch release is a doozy

4.
Top chipmakers embrace ASML’s $400M machines, agree to crucial chipmaking change

5.
“This is the AI men actually use”: Meta ads pushed apps nudifying real teens

Customize

Ars Technica has been separating the signal from
the noise for over 25 years. With our unique combination of
technical savvy and wide-ranging interest in the technological arts
and sciences, Ars is the trusted source in a sea of information. After
all, you don’t need to know everything, only what’s important.

More
from Ars

About Us
Staff Directory
Ars Newsletters
General FAQ
Posting Guidelines
AI Policy
RSS Feeds

Contact
Contact us
Advertise with us
Reprints

Manage Preferences


© 2026 Condé Nast. All rights reserved. Use of and/or
registration on any portion of this site constitutes acceptance of our User Agreement and
Privacy Policy and
Cookie Statement and Ars
Technica Addendum and Your
California Privacy Rights. Ars Technica may earn compensation on
sales from links on this site. Read our
affiliate link policy. The material on this site may not be
reproduced, distributed, transmitted, cached or otherwise used, except
with the prior written permission of Condé Nast. Ad
Choices

ASCII smuggling is a technique involving the use of an overlooked block of Unicode characters to embed malicious information in text in a manner that is invisible to human readers but readable by computers, which has recently been adopted by spammers to evade email filtering systems. This method originated as a way to make prompt injections into large language models more stealthy, where malicious instructions were encoded using specific Unicode tags, such as U+E0041 for "A," allowing the LLM to detect the instructions while remaining hidden from human scrutiny.

The fundamental mechanism relies on the fact that this block of 128 Unicode tags mirrors the American Standard Code for Information Interchange, possessing characters that are designed to be invisible to humans, yet they exist at the text-processing level. This property allows attackers to obfuscate keywords—such as financial terms or trigger words—by sprinkling the invisible tag characters into the middle of legitimate words. For example, by inserting an invisible tag into a word like "funding," spammers can cause text filters searching for a literal string, like "funding," to fail, while the intended word remains visible to the recipient. This is analogous to using zero-width spaces or non-breaking spaces, but the use of hidden Unicode tags is likely more effective because existing spam filters may not have been programmed to detect them.

The shift in focus for spammers is driven by the advances in machine learning and natural language processing models used in spam detection. The author notes that the primary objective is not just to bypass literal string matches but to counteract the capabilities of ML and NLP models. Since these models often process text by splitting it into tokens or sub-word pieces, inserting an invisible character can alter how the tokenizer interprets the text, potentially leading to rare or unknown sub-tokens or changes in token sequences that bypass detection routines. This means that standard email classifiers may miss these obfuscated attacks unless they employ more advanced techniques, such as optical character recognition or deeper reasoning over the context of the entire message.

The underlying Unicode structure provides the necessary framework. The Unicode standard includes a block of 128 characters known as the Tags block, which parallels ASCII. Although initially planned for use as language tags or for representing regional flag modifiers, these uses were ultimately abandoned. However, researchers have found that these tags remain understandable to some LLMs, indicating their deeper utility beyond human perception. While some specific flag modification functions have been deprecated, the concept of using this character set as a covert channel for information remains relevant, even if the practical application has evolved from language specification to a method of evasion. Consequently, filtering systems must evolve to better account for this method of obfuscation to maintain effective security against sophisticated attacks.