Invisible text is not just a display oddity. In some AI chatbot workflows, hidden Unicode characters can become a channel for instructions and data that people do not notice but some large language models can still process.
The issue matters because the hidden content can sit beside ordinary visible text. A user may paste it into a prompt without realizing it, or a chatbot may place it into an output that looks harmless on screen.
Why invisible characters matter to AI security
The underlying problem comes from a quirk in the Unicode text encoding standard. The standard includes characters that are designed not to render visibly in normal user interfaces, yet some AI systems can recognize them as text.
That creates what researchers describe as a covert channel. Malicious instructions can be concealed inside content sent to an LLM, while sensitive information can be hidden inside chatbot responses and carried out through text that appears normal to the user.
Joseph Thacker, an independent researcher and AI engineer at Appomni, described the impact after seeing GPT 4.0 and Claude Opus understand the hidden tags. He said the fact that they were invisible in browsers but readable by large language models made attacks more feasible in many areas.
The technique is often discussed as “ASCII smuggling.” The term refers to embedding invisible characters that mirror characters in the American Standard Code for Information Interchange. In practice, it lets visible text and hidden payloads occupy the same prompt, message, or link.
How ASCII smuggling worked in Copilot tests
Researcher Johann Rehberger, who coined the term, created two proof-of-concept attacks earlier this year against Microsoft 365 Copilot. The service can process emails, documents, and other content connected to a Microsoft user’s account.
In the tests, the main attack path was prompt injection. A user asked Copilot to summarize an email from an unknown or untrusted party. Hidden inside that email were instructions telling Copilot to search earlier messages for sensitive information.
The proof-of-concept attacks looked for two kinds of secrets:
- Sales figures in a user’s inbox.
- A one-time passcode in a user’s inbox.
When the information was found, the attack caused Copilot to encode it as invisible characters and attach it to a URL. The visible link looked ordinary, so a user would have little visual reason to distrust it when Copilot instructed them to open it.
The source describes the visible link as https://wuzzi.net/copirate/. A second version could look the same to a person while containing different Unicode code points, including hidden text. In Rehberger’s demonstration, the secret content could later be decoded from the web server logs with his ASCII Smuggler tool.
One decoded result showed the URL followed by the message “The sales for Seattle were USD 120000”. A separate URL contained the one-time password. Microsoft introduced mitigations for the attack several months after Rehberger privately reported it.
The Unicode block behind the issue
The Unicode standard defines binary code points for roughly 150,000 characters used in languages around the world, and it has capacity for more than 1 million characters. Inside that broad system is a block of 128 characters that parallel ASCII characters.
This range is commonly known as the Tags block. In an early version of Unicode, it was intended for language tags such as “en” and “jp”, which could indicate that text was written in English or Japanese. Those code points were invisible by design, but the plan to use them for language tagging was later dropped.
A later Unicode version planned to reuse the abandoned characters for country representation. For example, “us” or “jp” could be appended to a generic flag emoji to turn it into the official US or Japanese flag. That plan also failed, and the character block was retired again.
Riley Goodside, an independent researcher and prompt engineer at Scale AI, is widely acknowledged as the person who discovered that when these tags are not accompanied by a flag, they do not display in most user interfaces but can still be understood as text by some LLMs.
Why prompt injection makes it more dangerous
ASCII smuggling is not the whole attack by itself. In the Copilot proof-of-concept attacks, the main exploitation vector was prompt injection, where untrusted content is pulled into an LLM prompt and treated as instructions.
That combination is what makes the scenario practical. Prompt injection gives the attacker a way to influence the model’s behavior. Invisible Unicode text gives the attacker a way to hide either the incoming instruction or the outgoing data from the person using the system.
The source article points to a simple workflow: a user asks for an email summary, the email contains hostile instructions, Copilot follows those instructions across connected content, and the result is placed into a link that appears benign. The human sees an ordinary URL, while the underlying text carries more than the screen reveals.
This is especially relevant for AI assistants that can read private files, emails, or documents and then generate links, summaries, or other shareable text. The more trusted data a chatbot can reach, the more important it becomes to treat untrusted input and invisible output as security concerns.
What users and builders should take from it
The core lesson is simple: visible text is not always the full text. In AI chatbot systems, content can contain non-rendering Unicode characters that change what a model sees or what a browser sends.
For users, the risk is that a message, prompt, or link may contain hidden characters that cannot be spotted by looking at the screen. For developers and security teams, the issue points to the need for defenses that inspect and normalize text before it reaches a model or leaves one.
Rehberger’s ASCII Smuggler tool shows how the difference can be detected by decoding text that appears visually identical. That does not make the problem disappear, but it demonstrates that invisible characters are not mysterious once the underlying code points are examined.
AI chatbots are increasingly asked to work across email, documents, and account data. The Unicode Tags block shows how old text-encoding decisions can create new AI security problems when models, browsers, and users do not perceive the same message.