Spammers hid trigger words in invisible Unicode tags to slip past machine-learned filters

For about two years, ASCII smuggling was a niche trick in attacks on AI agents: malicious prompts written in the Unicode tag block (U+E0000-U+E007F), whose characters mirror ASCII but render invisibly, so an LLM reads instructions a human reviewer never sees. In early February 2026, Microsoft reported, spammers adopted the block at scale: Defender for Office detections of Unicode-tag signatures spiked from roughly 21,000 a day to more than 1.3 million, and to 2.5 million within four days. The deluge persisted for months, then fell off sharply in mid-May.

The mechanism inverts intent but not design. Invisible tags change nothing for the reader, who still sees 'funding', but they change what machines see. Literal filters hunting dollar amounts or words like 'credit' may match 'fun' and 'ding' instead. Modern classifiers fare worse: they tokenize text into sub-word pieces first, and an inserted tag breaks the familiar token for 'funding' into rare fragments, or is stripped by normalization, so the model no longer reasons over the word a human sees. Microsoft's gloss: intent inverted, mechanism similar, suspicion not raised.

Zero-width and non-breaking spaces had played this game for decades; what changed was the payoff. ML and NLP models now drive spam classification, and invisible tags defeat exactly the tokenization step those models depend on - short of screenshotting the message and running OCR, Microsoft noted, a classifier may miss the attack entirely. The company published guidance on programming filters to account for ASCII smuggling. The episode is a case of technique transfer: a trick built to smuggle instructions past human review of AI inputs works as well for smuggling keywords past machine review.

The same invisible Unicode tags that hide prompt injections from people can split a word at the tokenizer, so machines classify text the reader never sees.

The tag block is invisible by design, so one edit defeats human review and machine tokenization at once.

The adoption is measured, not anecdotal: signature detections went from about 21,000 per day to 1.3 million in a day and 2.5 million within four days, per Microsoft.

It documents transfer between two adversarial communities - AI prompt injectors and spammers - via a property both exploit.

It locates where the defense actually lives: not in string matching but in tokenization, which is why normalization or OCR over the rendered view is the fix.

A defense against one adversary becomes the next one's tool: what hides instructions from people hides keywords from machines. Fixes: normalize text, or OCR the rendered view.

Microsoft's Defender team tracked the campaign from its early-February 2026 onset to its sharp fall-off in mid-May, then published analysis and developer guidance: strip or normalize tag characters before classification, or classify over a visual rendering of the message. The tag characters remain in Unicode, and the same property keeps them useful for hiding instructions from AI agents, so defenders on both fronts now have to assume text the reviewer cannot see. Detections dropped, which suggests filters adapted, but the underlying contest - invisible bytes versus tokenizers - stays open.