ASCII smuggling — a technique once used to hide malicious prompts in attacks on AI agents — has found a new audience. Spammers are now using it to slip past email filters designed to flag unwanted messages in mass campaigns.
What Is ASCII Smuggling and How It Works
The technique gained attention two years ago as a way to make prompt injections — a class of AI attack — more stealthy. Instead of writing malicious instructions in ordinary text, attackers render them using a special range of Unicode tags. For example, the tag point U+E0041 mirrors "A," and U+E0061 mirrors "a."
This block of 128 tags mimics a portion of the American Standard Code for Information Interchange almost perfectly. That means text can be hidden in plain sight, appearing normal to human readers but carrying a hidden layer of meaning that machines can interpret differently.
From AI Attacks to Spam Evasion
What started as a tool for obscuring prompt injections is no longer limited to that purpose. Spammers have now adopted the same method to evade filters on email platforms. These filters are designed to catch unwanted messages used in mass campaigns, but ASCII smuggling lets spammers disguise their content in ways that slip past automated detection.
The shift is notable because it shows how a niche security concern can quickly become a broader nuisance. The same trick that made AI attacks harder to spot is now making spam harder to block.
Why This Matters for Email Users
For everyday users, the practical effect is simple: more spam may start reaching inboxes. Email platforms rely on filters to keep mass campaigns out, and if spammers can encode their messages using ASCII smuggling, those filters may not recognize the content as unwanted.
This does not mean all spam will suddenly get through, but it does mean filter systems need to evolve. Techniques designed for one threat — AI prompt injections — are being repurposed for another, and defenses must keep pace.
Our Take: A Reminder That Security Tricks Travel
To put it plainly, this is a reminder that techniques in security rarely stay in one lane. ASCII smuggling was developed and popularized in the context of AI attacks, but the underlying idea — hiding text in a way that machines misread — is useful anywhere filters exist.
In our view, the takeaway for email platforms is clear: they cannot assume that threats stay in the category where they were first seen. A method that works against one type of defense will likely be tried against others. For users, the practical advice remains the same as always — be cautious with unexpected emails, even if they look normal. The fact that a message appears ordinary does not guarantee it is safe.
