Once popular for attacking AI, ASCII smuggling is now embraced by spammers

In the special Unicode range, U+E0041 corresponds to the capital letter “A,” and U+E0061 corresponds to lowercase “a.” These characters are rendered by design as invisible in typical displays, allowing encoded material in an email to go unnoticed by anyone reading the message.

The technique caught attention two years ago as a way to make prompt-injection attacks on large language models stealthier. Malicious instructions were written not in plain text but in these tags inside emails or other content processed by an LLM, so the model would interpret the instruction without the user seeing the hidden text.

Ars Technica said spammers have now embraced the technique to avoid filters on email platforms that are designed to catch mass campaigns. The scheme no longer serves only to obscure prompt injections.