Once popular for attacking AI, ASCII smuggling is embraced by spammers

A stealthy trick once used to hide malicious prompts from AI systems is now being borrowed by spammers. The goal is simpler than the original use: slip past email filters that are supposed to catch mass unwanted messages. The technique has a name now, ASCII smuggling, and it is proving useful outside the prompt-injection world where it first drew attention two years ago.

The method works by hiding instructions inside a special range of Unicode tags instead of writing them as normal text. A tag like U+E0041 can stand in for “A,” and U+E0061 can stand in for “a.” To a computer, the text is there. To a person reading the message, it is almost invisible.

That is the neat part, and also the ugly one. AI models can still see the hidden instructions embedded in the message, while a human recipient may never notice anything odd. So the same formatting trick that helped make attacks on AI agents harder to spot is now being repurposed for spam.

The block used for this does not act like ordinary text. It mirrors a chunk of the American Standard Code for Information Interchange closely enough to fool the eye, but not the machine. That mismatch is exactly what makes it attractive to attackers.