AI Hacking Technique Used to Split Words in Spam Messages

This undermines safety mechanisms designed to flag harmful or deceptive content

For two years, researchers have explored how invisible Unicode characters can conceal instructions from human eyes while being readable by artificial intelligence systems. Microsoft recently discovered that spammers are now exploiting this same technique to manipulate how AI models interpret text, specifically by splitting the word fundingacross hidden characters to bypass content filters. This method allows malicious actors to evade detection while triggering unintended responses from language models. The trick relies on zero-width or non-displaying Unicode characters that are invisible in standard text rendering but still processed by AI parsers. By inserting these characters between letters of words like funding,spammers can fracture the word in a way that humans perceive as normal, but AI systems may misread or misclassify.

This undermines safety mechanisms designed to flag harmful or deceptive content, particularly in phishing or fraud schemes where funding-related language is common. How Invisible Characters Undermine AI Safeguards These hidden characters do not alter visual appearance but change the underlying data stream that AI models analyze. When a language model encounters ffollowed by a zero-width space, then u,then another invisible mark, and so on, it may not recognize the sequence as the word funding. This allows spam messages containing financial lures or scam prompts to slip through filters trained on keyword detection. Microsoft’s threat intelligence team observed this tactic in real-world email campaigns targeting businesses, where the spoofed content appeared legitimate to recipients but was engineered to confuse AI classifiers. Can AI Systems Defend Against Invisible Text Attacks? Defending against such techniques requires updating AI input processing to detect and normalize anomalous Unicode sequences before interpretation.

Current models often pass through raw text without stripping non-printing characters, creating a vulnerability

Current models often pass through raw text without stripping non-printing characters, creating a vulnerability. Researchers suggest implementing preprocessing layers that flag or remove invisible characters unless they serve a legitimate linguistic purpose, such as in certain language scripts. However, overzealous filtering could disrupt legitimate text, so any solution must balance security with usability. Ongoing work focuses on improving model robustness to adversarial inputs without degrading performance on genuine language tasks. Frequently Asked Questions How do invisible Unicode characters bypass AI detection? They alter the internal representation of text without changing how it looks to humans, causing AI models to misinterpret or fail to recognize specific words or patterns. Why is splitting the word „fundingsignificant in spam? The word ”fundingfrequently appears in financial scams; splitting it helps evade keyword-based filters while preserving the deceptive message for human recipients. Are these attacks limited to email spam?

No, similar techniques could apply to any text-based system relying on AI for content moderation, including social media, chat platforms, or automated customer service tools.