Microsoft Hides a Phishing Trick in Plain Sight, and LLMs Are Next

Microsoft caught a phishing campaign doing something clever with characters you cannot see. The attackers stuffed invisible Unicode tag characters into email bodies. On screen the message looks clean. The underlying string that software processes is a different story.

This is the same trick security researchers have documented against large language models for a while. They call it ASCII smuggling. One text becomes two versions. Humans read one, machines process another.

A gap in how machines read text

The trick rests on a gap between how we see text and how software reads it. Unicode tag characters live in a range of the standard, U+E0000 through U+E007F. They carry no visual glyph. Your screen renders nothing. A parser that treats raw code points as instructions sees hidden content.

Spam filters read the raw string. They scan for flagged words, suspicious links, and classic phishing patterns. Invisible tag characters let attackers split a word into pieces. The filter sees the fragments and shrugs. Your mail client drops the invisible characters. You see the phrase the attacker wanted.

Microsoft said the campaign ran at scale. That matters. A single clever message is a novelty. A campaign that works across thousands of inboxes is a signal the approach is profitable.

The same hole, now aimed at AI

LLMs ingest external text all the time. Emails summarized by a tool, web pages pulled into a context window, documents fed to a model for review. Those systems read characters the way filters do. They see code points, not pixels.

So the same invisible characters can hide instructions from a model. A page can look like a benign article to a human and carry a command to the system prompt. The model follows text it thinks is part of the request. The user never sees the injected instruction.

That is the definition of prompt injection. ASCII smuggling is one of its most stubborn vectors. It defeats the simplest defense because there is nothing visibly wrong to catch. The abuse is invisible.

What this means for AI security

The lesson is not that filters need one more signature. It is that anyone building a pipeline that reads external text has to treat character-level input as hostile. Two layers need defense together.

One, sanitize the input. Strip tag characters, unicode noncharacters, and homoglyphs before a string reaches a classifier or a model. Normalize the text to a canonical form first. Detection is easier when the hidden bytes are gone.

Two, treat the model as a target, not a filter. No sanitizer is exhaustive. The system prompt and the tools a model can call should be hardened against instructions smuggled into the prompt. Assume a hidden instruction can land. Design so a bad instruction cannot escalate.

There is a deeper point here. Security tools and AI systems share a blind spot. Both process text as bytes, enough to lose the version a human sees. Microsoft flagged a phishing campaign, but the underlying weakness is general. The same characters that break a spam filter can break an AI agent.

The two problems are one problem. That is the takeaway.

A filter rewrite alone will not save you. Neither will another layer of prompt engineering. You fix the input, and you armor the agent. Do both, or neither holds. It is the kind of gap that is easy to dismiss, because the world moves on screens, not in code points. The attackers already know the difference.

Source. ASCII Smuggling in AI Pipelines

The deeper worry is that this is not one technique. It is a category. Once attackers prove a trick works in one pipeline, they adapt it to the next. An email filter that reads the rendered text and a model that reads the raw string can be fooled by the same input. That mismatch is the attack surface.

For teams building agents that ingest documents, the fix is unglamorous. Normalize and sanitize input before it reaches the model. Strip or flag non-printable and tag characters. Log what the model actually received, not what the interface showed. Treat external text as untrusted until proven otherwise.

Supply chain accountability runs through this. The 2026 State of Enterprise Infrastructure report covers what organisations are actually absorbing and which tooling holds up.

Related reading. K8sGPT Turns Cluster Error Messages Into Fixes a Human Can Use. Treat Your AI Agent Rules Files Like the Code They Replace. OpenAI’s Own Agents Broke Into Hugging Face. The Goal Was to Cheat a Test.. AI Infrastructure Runs on Four Layers. Most Break Below the Model..