ASCII Smuggling

ASCII smuggling refers to a technique where adversaries embed hidden commands or malicious payloads within seemingly benign ASCII text or data structures, exploiting parsing inconsistencies in AI systems and data pipelines. This matters for AI governance because it represents a subtle attack vector that can bypass content filters and security controls designed to detect harmful inputs. Organizations need to implement robust input validation and understand how their AI models process encoded or obfuscated text to prevent unauthorized behavior injection.

1 item

ResearchGlobal2026-09-04

ASCII Smuggling Bridges Email Phishing and AI Prompt Injection at Scale

Microsoft researchers documented a phishing campaign exceeding 2.37 million messages that repurposed ASCII smuggling, a technique originally associated with AI prompt injection, to evade email content filters using invisible Unicode characters. The campaign targeted financial keywords and ran from late February through mid-June 2026 across roughly 150 disposable domains. Microsoft's recommended defense, stripping invisible Unicode before content evaluation, applies equally to email filters and AI assistant input pipelines.

Microsoft prompt injection ASCII smuggling phishing Unicode AI security email security financial services