A clever technique used to hide malicious prompts in attacks on AI agents has been adopted by spammers to evade filters on email platforms designed to flag unwanted messages in mass campaigns. The technique, known as ASCII smuggling, gained attention two years ago for making prompt injections stealthier.

Malicious instructions aren't written in ordinary text but rendered by special Unicode tags. For example, U+E0041 mirrors “A,” and U+E0061 mirrors “a.” The block of 128 tags mimics ASCII almost perfectly, but the characters are readable by computers yet nearly invisible to humans.

Earlier this year, Microsoft saw a massive increase in spam using this technique. In early February, ASCII smuggling signatures detected by Microsoft Defender for Office spiked from roughly 21,000 per day to more than 1.3 million. Within four days, detections jumped to 2.5 million, persisting for months before falling off in mid-May.

Microsoft explained that because tag characters are invisible to humans but exist at the text-processing level, they’re useful for obfuscating keywords before a detector evaluates them. The intent is inverted, but the mechanism is similar, and a user’s suspicions are not raised.