Science and Technology › Computing and AI › Software and platforms
Cyber security
Unicode carries characters that software reads but a screen never shows. Slipping them into ordinary text is called ASCII smuggling, and in September 2026 it turned up in spam: a hidden character splits a word, so an email filter no longer recognises it while the reader sees nothing unusual. The same trick was used first against AI agents, to plant instructions they would obey.
How invisible characters get into ordinary text
Hide
Tag characters are slipped into a message, inside a word such as funding or as hidden instructions
Software reads them
A spam filter reads fun and ding instead of funding, and an AI tool obeys the hidden instructions
Human sees nothing odd
The reader sees only funding and ordinary text
- Unicode extends ASCII to the world's scripts, keeping ASCII as its own first 128 characters.
- Unicode's tag characters copy those 128 but never show on screen.
What has happened
3 Sep 2026
ASCII smuggling was reported in use by spammers getting past AI email filters.
- The technique was first used for prompt injection, against AI agents rather than filters.