ASCII Smuggling Technique Adopted by Spammers to Evade Email Filters

<p>A technique known as ASCII smuggling, which was previously used to hide malicious prompts in attacks on AI agents, has been adopted by spammers to bypass filters on email platforms designed to flag unwanted messages in mass campaigns.</p><p>ASCII smuggling gained attention two years ago as a method to make a type of AI attack called <a href="https://arstechnica.com/security/2026/07/hackers-can-use-9-of-the-most-popular-ai-tools-to-assemble-massive-botnets/">prompt injections</a> more stealthy. Malicious instructions embedded in emails or other untrusted content processed by a large language model (LLM) are not written in standard text; instead, they are rendered using a specific range of <a href="https://en.wikipedia.org/wiki/Unicode">Unicode</a> tags. For instance, the tag point U+E0041 represents “A,” and U+E0061 represents “a.”</p><h2>No longer just for obscuring prompt injections</h2><p>The block of 128 tags closely resembles a segment of the <a href="https://en.wikipedia.org/wiki/ASCII">American Standard Code for Information Interchange</a> (ASCII), with one significant difference: the characters they encode are readable by computers but are nearly invisible to humans. By encoding malicious prompts in these tags, LLMs can detect the instructions, while individuals reading the email do not see them. More information about ASCII smuggling can be found <a href="https://arstechnica.com/security/2024/10/ai-chatbots-can-read-and-write-invisible-text-creating-an-ideal-covert-channel/">here</a>.</p>