ASCII smuggling is an evasion technique where attackers hide content by inserting invisible or non-rendering Unicode characters into text. The message may look normal to a person, but software that searches, splits, or classifies the raw string can see a different sequence of code points. That mismatch can break keyword matching, confuse tokenizers, or make security tools miss suspicious terms.
In real attacks, this is used in phishing lures, prompt-injection payloads, and other text-based abuse to bypass simple filters. For example, a word like “loan” can be split by an invisible character so it still reads correctly on screen but no longer matches a rule looking for the exact token. Defenders reduce this risk by normalizing text, inspecting raw code points, using Unicode-aware parsing, and flagging rare or unexpected characters in high-risk messages. The key lesson is that security checks must analyze the text structure, not just its rendered appearance.