ASCII smuggling: invisible characters in phishing and AI prompts

TL;DR

• A phishing email can contain words you read normally but your email filter does not recognise. Between the letters sit Unicode characters that never show up on screen.
• On 3 September 2026, Microsoft described a campaign built on this: financial lures, more than 2.3 million messages on its peak day.
• The trick comes from prompt injection research, where the same characters hide instructions from an AI assistant.
• Your staff cannot see this, so awareness alone will not fix it. A filter that normalises Unicode and a test of your mailbox assistant will.

You get an email about business funding. Ordinary sentences, an ordinary sender, nothing that stands out. Your email filter reads something else. Between the letters of the word "funding" sit characters your mail client never draws. You see funding; the filter sees fun, something it cannot read, and ding. That is ASCII smuggling: hiding text with Unicode characters that exist but never appear on screen.

The technique first showed up in attacks on AI assistants. Since early 2026 it has been in ordinary phishing too, at scale. That changes how a company should think about it. An invisible character is not a clue a colleague could have spotted. Our social engineering assessments measure how your people respond to a realistic phishing email and which teams need extra training. With Swishing they practise the decision in short sessions. For this kind of phishing, though, the first line of defence has to sit somewhere else: in your mail pipeline, not in the inbox.

How ASCII smuggling works in phishing

Unicode has a block of characters called Tags. It holds an invisible twin of every ordinary ASCII character: an invisible A, an invisible space, and so on. It was meant for language labels and today survives mostly in a handful of flag emoji. Almost nothing renders the characters. A mail client skips them, a browser does the same.

A keyword filter works differently. It compares strings. Put an invisible space in the middle of "funding" and the filter is looking at a different word. The rule meant to stop financial lures walks straight past it. The recipient notices nothing, because to them it still says funding.

On 3 September 2026, Microsoft described a campaign that did exactly this. On 8 February 2026 it counted roughly 21,000 messages carrying such characters; on 9 February, more than 1.3 million; on the peak day, more than 2.3 million. Nearly all of it came from senders with a finance theme, offering business loans and credit lines. By late March the volume had dropped, and after mid-May little was left.

One nuance that matters: Microsoft also reports that more than 99 percent of those messages were caught anyway, by layers that do not depend on spotting the hidden characters. The trick beat one check, not the whole stack. That is reassuring if your mail is set up well, and less so if you lean on keyword rules.

Where it started: prompt injection

In January 2024 a researcher at embracethered.com showed how characters from that Tags block can hide a complete instruction inside text that looks normal. A person sees a plain sentence. A language model reads the invisible characters too, and does what they say. In the demo, hidden text made a well-known AI assistant generate an image nobody had asked for.

That is prompt injection: text that should be input behaves like a command. We explained it in our post on prompt injection. By 2025 ASCII smuggling was a standard part of that research. Phishers turned it inside out. In prompt injection the human must not see the text and the model must. In phishing the human has to read the text and the filter must not. Same characters, opposite intent.

Microsoft found the campaign while hunting for prompt injection in email, which is a nice irony. The first version of its query flagged every Tags character and so also caught the flags of England, Scotland and Wales. Those emoji are built from exactly those characters.

Why awareness alone will not fix this

The usual answer to phishing is training. Teach people the signs: a sender that does not add up, pressure to act fast. That stays useful. But with ASCII smuggling there is nothing to spot. To the reader, the email looks identical with or without the characters. Someone who clicks has not missed a signal. There was no signal.

This decides how you handle an incident. An employee who acts on such an email is not the culprit. The filter should have normalised the message and did not. Push the blame onto the person and you learn the wrong lesson while the real gap stays open.

The same goes for the AI assistant in your mailbox. If an assistant summarises or answers your mail, it gets the raw text, invisible characters included. An instruction you cannot see, it can. No training helps there, because the human is not even in the loop.

What does help

Four things, in order of payoff.

Have your mail filter normalise Unicode before it compares. Microsoft's phrase for it is "normalize before you match". Strip or fold Tags characters and zero-width characters before any rule looks for keywords. Ask your IT partner or mail provider whether that already happens. Often nobody is sure.

Treat mail content that goes to an AI assistant as untrusted. An email is input from a stranger, even when the assistant summarises it neatly. Normalise the text there too, and do not give the assistant rights a phishing email could abuse: replying or forwarding on its own, let alone preparing a payment.

Test your mailbox assistant for hidden instructions. Send it an email with an instruction in invisible characters and watch what it does. In an AI systems penetration test we do exactly that, against the assistant as it runs in your environment.

Keep realistic phishing simulations for the rest. Most phishing is perfectly visible, and there the decision your people make still counts. A phishing test measures who clicks and which teams need another round. How we turn that into a game rather than a slide deck is in our post on gamified phishing simulations.

Frequently asked questions

What is ASCII smuggling?

ASCII smuggling is hiding text with Unicode characters that do not appear on screen, mostly from the Tags block. A person sees ordinary text; a program or language model that reads the raw characters sees more.

Can I see invisible characters in an email myself?

Not in a normal mail client. You only see them if you open the raw source of the message or run the text through a tool that shows every character. You cannot expect that of your staff.

Is this the same as prompt injection?

No, but it is the same technique. In prompt injection the characters hide an instruction from an AI model. In phishing they hide words from an email filter. In both cases the machine reads something different from the human.

Does security awareness training help against ASCII smuggling?

Not directly, because there is nothing to recognise. Training does help against the rest of phishing, which is far larger. That is why we combine Swishing with technical measures in the mail pipeline.

How do I test whether my email filter is vulnerable to this?

Send a test email with a known lure word that has invisible characters inside it, and check whether the rule still fires. If it does not, your filter is not normalising. A phishing test can include such a variant.

Is the AI assistant in my mailbox at risk?

Any assistant that reads raw email text also receives the invisible characters. Whether it acts on them depends on the model and on what the assistant is allowed to do. You only know for sure once you test it as it runs for you.

Related services and resources

If you want to know how your people respond to phishing that is visible, start with our social engineering assessments or a targeted phishing test. Swishing trains the decision in short sessions. If an AI assistant runs in your mailbox, we test it for hidden instructions in an AI systems penetration test. For background, read our posts on what phishing is, prompt injection, gamified phishing simulations and what Swishing is. The technical details of the campaign are on the Microsoft Security blog of 3 September 2026; the origin of the technique is documented at embracethered.com, January 2024.