Spammers Are Now Using a Trick Designed to Attack AI Chatbots

Key points

• ASCII smuggling, a method for hiding text from human readers using special Unicode characters, has moved from targeting AI systems to evading mainstream email spam filters.
• The technique uses a block of 128 special Unicode tags, a system for representing characters in digital text, that computers read normally but human eyes almost never see.
• Spam filters built on AI can still detect the hidden instructions, but only if they have been specifically trained to look for them.
• The shift means some spam and phishing emails may now slip past filters that would otherwise catch them.

You would never know it was there. A spam email arrives, looks blank or harmless, and sails through your inbox filter. Hidden inside is a set of instructions, written in characters your eyes cannot see but your email platform's software reads perfectly. That trick has a name: ASCII smuggling.

ASCII, short for American Standard Code for Information Interchange, is one of the oldest systems for turning letters and numbers into digital data. Nearly every piece of text on your screen relies on it. Unicode is a much larger, modern version of the same idea, covering characters from hundreds of languages and scripts.

How does the hiding actually work?

Smuggling works by swapping ordinary letters for near-identical Unicode tags that are, by design, invisible on screen. The tag U+E0041 behaves exactly like a capital "A" to a computer but shows as nothing to a reader. A full block of 128 such tags can mirror the entire basic ASCII alphabet.

An attacker writes their hidden message using only these invisible characters. The computer processing the email sees every word. You see nothing at all.

The technique first drew serious attention roughly two years ago as a way to make prompt injections harder to spot. A prompt injection is an attack where hidden text tricks an AI assistant, such as one that reads and summarises your emails, into following secret instructions: forwarding your messages, leaking your contacts, or clicking links on your behalf.

Why are spammers suddenly interested?

Spammers want their emails to reach inboxes. Filters, including AI-based ones, scan message content for suspicious words and patterns. By encoding the real payload of a message in invisible characters, spammers can make the visible text look innocent. The filter scans what it sees. What it sees is nothing.

Ars Technica reported the technique spreading into bulk spam campaigns, a notable shift from its earlier use against AI agents specifically.

Whether a filter catches it now depends on whether it was built to look beyond visible text. Many were not.

What does this mean for ordinary email users?

For most people, the practical risk is phishing: a message that looks safe, passes the filter, and then asks you to click a link or hand over a password. The invisible layer is not something you can spot yourself. Your eyes will never reveal it.

The sensible steps remain what they have always been. Treat unexpected emails asking for action with suspicion, even if they arrive in your main inbox rather than your junk folder. Do not click login links inside emails; type the address yourself. If your workplace runs phishing-awareness training, take it seriously: filters are one layer of protection, not the only one.

Email providers will update their filters. They always do. But there is always a gap between a new evasion trick appearing and defences catching up, and right now that gap is open.

Common questions

Can I see the hidden text if I check the raw email source?

Does this affect every email provider?

Most major providers, such as Gmail and Outlook, will update their filters as researchers publish findings. Smaller or self-hosted mail servers may lag behind, so business IT teams should check whether their spam filters have been updated to scan Unicode tag characters.