Spammers borrowed the prompt-injection character block to split "funding" in half

The first version of Microsoft's hunting signature had one recurring false positive, and it is the most instructive line in the writeup: it kept alerting on legitimate mail carrying the flags of England, Scotland and Wales, because those three emoji are assembled from the same invisible tag characters ^[15]. Any team that reaches for a strip-everything rule at the intake boundary inherits that population.

The block is a leftover. Unicode created U+E0000 to U+E007F for language tagging, abandoned that, then mostly failed to repurpose it for regional flags ^[4], leaving an invisible shadow copy of printable ASCII in the standard, where U+E0041 mirrors a capital A ^[2]. The technique of using it this way is called ASCII smuggling ^[3].

What the spam did with it is duller than the research. Against a filter matching a literal string, splitting a lure word hides the word ^[7]. The bigger target is the classifier, which tokenises text before it reasons about it, so one invisible character can turn a familiar token into two unfamiliar fragments or a sub-token the model has barely seen ^[11]. Microsoft's own phrasing: "The intent is inverted, but the mechanism is similar, and a user's suspicions are not raised" ^[1].

It bought nothing. Defender screenshots message content and reads the text back with OCR, which sees the word the way the recipient does ^[13]. Take Microsoft's accounting of its other layers at face value and the arithmetic is unkind: one percent of the heaviest weekday, 2.37 million messages ^[9], is about 23,700 ^[20], and that is the ceiling on what the invisible characters could have delivered even if everything else had missed. Thirteen weeks of weekdays at that volume is roughly 65 to 154 million messages sent ^[22] to sneak a keyword past filters that were not reading keywords.

Separate the thing being demonstrated from the thing being done. The demonstrations are real. A hidden line in a Word document rewrote figures in a spreadsheet and infected the next file ^[17]. In September a researcher hijacked Claude Code by asking it to summarise a web page ^[18], and another team fed an OpenClaw agent a phishing email and got AWS keys out of it ^[19]. The character is identical in all of these; what differs is what stands behind the reader, since mail has half a dozen independent checks that never look at the body text ^[12] and an agent reading a page has whatever you wrapped around the model.

So the test worth running on your own product is a two-column one. For every place it ingests text you did not author, write down whether a person's eyes reach that text before anything acts on it, and what non-text signal you hold: sender identity, a domain allowlist, an approval step before a side effect. Surfaces with an entry in neither column are where tag characters change an outcome, and for most products that surface is the agent, not the mailbox. The cheap move there is to log tag characters rather than strip them, since their rarity is worth more as a high-confidence indicator ^[14] than their removal is as a fix; the tradeoff is that a log line does nothing for the agent that has already followed the instruction.