Prompt injection · News & analysis
Invisible text, visible risk: what ASCII smuggling means for AI security
Microsoft’s September research connects invisible Unicode text with phishing evasion. What engineering teams should check in email and AI workflows.
Microsoft’s September 3 research describes a phishing campaign that inserted invisible Unicode characters into financial language. The visible message looked ordinary, while the underlying text could confuse detection systems. The researchers found the activity while investigating a technique associated with AI prompt injection.
The distinction matters: Microsoft says the observed messages used character insertion for filter evasion, rather than carrying hidden instructions for an AI assistant. Its report describes activity observed earlier in 2026, not a campaign that first appeared in September.
A text preview is not a complete security review
Our reading of the report is that teams should review how text changes as it moves between systems. An email can pass through a gateway, an archive, a search index and an AI summarizer. Each step may normalize characters differently. A person approving the final summary may never see the representation the model actually received.
Consider a finance assistant that summarizes incoming invoices and proposes a supplier-bank update. The important boundary is the action: can text from an external sender influence a payment instruction? Treat the message as evidence to examine. The sender’s content must not supply the authority to change a financial record.
Test the whole workflow, not just the model
Build a small regression set with ordinary international text, legitimate emoji, suspicious formatting and harmless examples of instruction-like content. Check what each stage stores and displays. A detector that strips every unusual character may damage valid messages, while a detector that preserves everything needs a reliable way to expose anomalies.
A useful test ends with an observable result: the assistant can summarize the message, but cannot silently turn its contents into a privileged instruction. Keep the original sample, the normalized representation and the resulting decision together. That makes a later review possible without relying on a screenshot of the final answer.
- Document which system normalizes text and which representation reaches the model.
- Require an independent check before payment, credential or access changes.
- Retain enough original message context to investigate a false positive or missed detection.
Make the approval meaningful
For a small team, the first improvement can be narrow. Pick one workflow that reads external messages and performs an important action. Ask the approver to verify the destination, recipient and source record, rather than approve a fluent paragraph. A trustworthy summary is useful; a verified action is the security outcome.
Put your security work in motion.
Book a meeting