Microsoft's threat intel team flagged something last week that should've been obvious in hindsight: spammers are now using ASCII smuggling in email campaigns. Not AI red-teamers. Not prompt injection researchers. Actual spam operators, using a technique that, until recently, mostly showed up in conference talks about jailbreaking chatbots.
That's the real story here. A technique gets battle-tested against LLMs, works well enough, and migrates downstream into commodity abuse. If your detection stack only thinks about ASCII smuggling as "an AI problem," you already missed the point.
What ASCII smuggling actually is
Unicode has a block of characters called "tags" (U+E0000 through U+E007F) that were originally designed for language-tagging purposes. They're valid Unicode code points. Most rendering engines and mail clients don't display them at all — they're invisible in the UI, but they're still there in the byte stream, and any system parsing raw text (a model tokenizer, a regex filter, a downstream script) sees them.
The attack: encode a hidden instruction or payload using these invisible tag characters, embed it inline with normal-looking visible text, and send it through. A human reading the email, or the rendered output, sees nothing unusual. A system parsing the underlying text sees the full payload, hidden characters included.
