A sophisticated technique originally developed to conceal malicious instructions in AI-agent attacks is now being used by spammers to bypass email security filters. The method, known as ASCII smuggling, helps attackers hide unwanted messages and phishing content from automated detection systems.
ASCII smuggling gained attention about two years ago as a way to make prompt injection attacks more difficult to detect. Instead of displaying malicious instructions as ordinary text, attackers encode them using a special range of invisible Unicode tag characters. For example, the tag character U+E0041 represents “A,” while U+E0061 represents “a.”
ASCII smuggling moves beyond AI prompt injection
The Unicode tag character range contains 128 characters based on the American Standard Code for Information Interchange, or ASCII. These characters are readable by computers but are almost entirely invisible to people. As a result, attackers can embed malicious prompts or spam-related keywords in emails that appear harmless to human recipients.
When the hidden content is processed by a large language model (LLM), the model may still interpret the encoded instructions. At the same time, conventional email filters may fail to detect keywords associated with spam, phishing, or other malicious activity. This makes ASCII smuggling useful for both AI prompt injection and email security evasion.
Microsoft reported a major increase in spam campaigns using the technique earlier this year. On one day in early February, Microsoft Defender for Office detected approximately 21,000 ASCII smuggling signatures. That figure quickly rose to more than 1.3 million detections per day. Within four days, detections reached 2.5 million.
The wave of activity continued for several months before declining sharply in mid-May. Microsoft said the campaign demonstrates how techniques developed for AI attacks can be repurposed to bypass traditional cybersecurity defenses.
“Because tag characters are invisible to humans but exist at the text-processing level, the same properties that help smuggle instructions into models also help obfuscate keywords before detectors evaluate them,” Microsoft explained on Thursday. “Although the intent is reversed, the mechanism is similar and does not raise user suspicion.”
Source: arstechnica.com