Attackers have weaponized invisible Unicode characters to evade spam filters and machine learning classifiers at massive scale, with one phishing campaign ballooning from 21,000 flagged messages to more than 2.3 million in just three days. Microsoft Defender for Office 365 documented the campaign last week, warning that the same method—inserting tag characters that software reads but humans can't see—poses a threat to AI systems that routinely pull in text from outside sources. The company says the technique is already being deployed widely to slip past content filters by fracturing keywords that security tools hunt for.
The phishing operation targeted financial keywords like "funding," "loan," and "credit" by embedding Unicode tag characters—code points between U+E0000 and U+E007F—inside those words. A person viewing the email sees "funding" displayed normally, but the underlying character string that filters scan becomes "fun⟨U+E0020⟩ding," breaking the exact match that detection signatures rely on. Microsoft's hunting signature for this technique, known as ASCII Smuggling, fired on roughly 21,000 messages the day before the surge began. The following day, detections jumped to more than 1.3 million messages, then climbed past 2.3 million just 48 hours later. Throughout the campaign, recipients saw what appeared to be routine business loan and credit line offers.
Security researchers have documented a nearly identical method aimed at large language models, which also exploits Unicode tag characters to create a gap between what people read and what software processes. The report notes that natural language processing systems tokenize text before analyzing it, and inserting an unexpected Unicode character into a word can alter how those tokens form—though the exact outcome varies by tokenizer. Some may disregard the tag character entirely, while others split the surrounding text in new ways, meaning developers must test their specific models rather than assume uniform behavior. Standard Unicode normalization methods like NFC and NFD won't necessarily strip these tags out, since they were designed to handle different representations of the same character, not to remove Unicode tag characters outright.
The problem becomes more acute for AI agents that ingest outside text and use it to guide decisions, according to the report. Email providers can flag suspicious messages using signals beyond the words themselves, but an AI pipeline may be working with far less context. Invisible characters embedded in that text can reshape how it gets processed downstream, while also making a hidden prompt injection much harder for someone reviewing the original input to spot. For applications with no legitimate need for characters in the U+E0000 to U+E007F range, the simplest fix is to strip them out before the text reaches the model, though that becomes trickier when an application has valid reasons to preserve them—subdivision flag emojis for England, Scotland, and Wales, for instance, rely on invisible tag sequences to render correctly, and Microsoft's initial detection rule was broad enough to trigger on those flags before the team carved out an exception.
The report recommends that developers compare the original text with a version that has tags removed and check for discrepancies, while also testing how their actual tokenizer handles these characters. Whatever version gets sanitized should remain consistent through the rest of the pipeline, rather than validating one copy and then sending the unfiltered original to the language model. The takeaway is blunt: invisible Unicode tags are already being exploited at scale to fool filters, and AI systems that assume text is what it appears to be are leaving themselves open to manipulation. Organizations that rely on agents to process external content will need to decide whether the flexibility of accepting all Unicode ranges is worth the risk of letting adversarial prompts slip through undetected. The trade-off between supporting legitimate edge cases and closing off attack vectors will force security teams to weigh convenience against control in ways that legacy email defenses never required.