Microsoft reports that bulk email operators have begun using ASCII smuggling to get past platform filters. The technique hides instructions or content inside Unicode codepoints that render as nothing to a human reader while remaining fully present in the byte stream that a language model tokenises. It has been documented in AI security research for about two years. Its arrival in commodity spam is the significant part.
The mechanics, briefly
Certain Unicode ranges, in particular the tag characters, carry no visible glyph in mainstream renderers. Text encoded in them is invisible in a mail client and invisible to a human reviewer. It is not invisible to a tokeniser. A message can therefore carry one payload for the person and a different payload for any model processing the same message, with no visual cue that the two differ.
Against a legacy filter the value is evasion: keyword and signature rules operating on the rendered or normalised text never see the hidden content. Against a mail platform that has inserted a model into triage, summarisation, or auto-reply, the value is instruction. The hidden text can address the model directly, and the model has no principled way to distinguish an instruction embedded in content from an instruction issued by its operator.
The adoption curve is the news
Offensive techniques move along a predictable path: demonstrated in research, adopted by well-resourced intrusion sets, then commoditised into mass-market crime once tooling exists that requires no understanding of the underlying mechanism. Prompt injection has been at stage two for a while, appearing in targeted work against agentic systems. Bulk spam is stage three.
Commoditisation changes the defensive maths. A technique used by a handful of capable actors against high-value targets is a threat-hunting problem. The same technique embedded in spam kits and sold as a feature arrives at every mailbox in volume, and volume is what finds the organisations that deployed a model in front of their inbox without changing anything about how they handle untrusted input.
The control is normalisation, and the detection opportunity is the discrepancy
The mitigation is unglamorous. Strip or reject tag-block and other zero-width codepoints at ingest, normalise text before it reaches any model, and apply the same normalisation to what the filter sees and what the model sees so the two cannot diverge. Input filtering has a poor reputation in prompt-injection defence for good reason, but this specific case is a character-class problem with a deterministic answer.
The more useful point for anyone doing detection: a message in which the model-visible text differs from the human-visible text is a strong indicator on its own. There is no benign reason for an ordinary commercial email to carry invisible instructions. The discrepancy can be computed cheaply, it does not depend on knowing what the payload says, and it survives changes in the payload. Organisations that log that delta now will have a usable signal before the technique’s next iteration, which will not use the same character ranges.
The wider read
Every layer that puts a model between untrusted text and an action has inherited an attack surface that email security spent thirty years hardening for humans. The hardening does not transfer. Spammers have found this first because spammers always find it first, and their volume makes them a useful early sensor for what more capable actors will do quietly later.