A block of Unicode called Tags encodes letters that computers read but people can’t see. This lab hides a message in that invisible layer — and shows you how to catch it.
Unicode reserves a block called Tags from U+E0000 to U+E007F. Almost all of it mirrors plain ASCII: U+E0041 stands in for “A”, U+E0061 for “a”, U+E0020 for a space. The characters exist in the text and travel with it, but fonts render them to nothing, so a person sees only the cover text.
This is not a party trick. The exact carrier this page demonstrates — the Unicode Tags block — is a live technique known as ASCII smuggling. It has had two lives, and a user’s suspicions are never raised in either one.
Malicious instructions are written in invisible tags and pasted into an email, a web page, or a document an LLM will process. The model reads the hidden commands as ordinary text; the human reviewing the same content sees nothing. This is a stealthy form of prompt injection, and it’s where the technique first drew attention.
Spammers slip invisible tags inside trigger words so a filter no longer recognizes them, while the recipient reads the word normally. Same mechanism, inverted goal: instead of adding a hidden instruction, they’re hiding a visible keyword from the machine that scores it.
In early 2026, Microsoft watched the second use explode. Daily hits on its ASCII-smuggling detection signature in Microsoft Defender for Office jumped from a low baseline of roughly 21,000 a day to more than 1.3 million on a single day in early February, and to 2.5 million within four days. The bulk of it was finance-themed spam — fake pre-approvals for credit lines and “bridge funding.”
The email angle is subtler than plain hiding, and it is aimed squarely at machine-learning classifiers. A word like funding is a clean, familiar unit to a model’s tokenizer. Slip an invisible U+E0020 into the middle and the tokenizer may split it into fun and ding, or emit rare tokens the model has never weighted — while the recipient still reads “funding.” The lure survives; the filter’s view of it does not. Want to see it? Load the spam lure in the Inspect & clean panel above and X-ray it.
“Because tag characters are invisible to humans but exist at the text-processing level, the same property that makes them useful for smuggling instructions into a model also makes them useful for obfuscating keywords before a detector evaluates them. The intent is inverted, but the mechanism is similar, and a user’s suspicions are not raised.” — Microsoft, quoted by Ars Technica, Sept. 2026
Camouflaging trigger words isn’t new — spammers have leaned on zero-width and non-breaking spaces for decades to break literal-string matches. What’s new is the target. The bigger prize is no longer defeating a keyword search; it’s defeating the ML- and NLP-based models that now drive spam and phishing classification. Unless a filter renders the message to an image and runs OCR over it, the invisible tags can quietly change what the model “reads.”
Reporting and figures drawn from Dan Goodin, “Once popular for attacking AI, ASCII smuggling is embraced by spammers,” Ars Technica, Sept. 4, 2026, which is based on research published by Microsoft. This page is an independent educational demo and is not affiliated with either.
Real primitives, no simulated math. Crypto via WebCrypto SubtleCrypto. Everything runs client-side.