Microsoft reported in September 2026 that techniques associated with hiding instructions from AI systems are also being used in phishing evasion.
One example involves invisible or deceptive Unicode characters.
The basic idea is important: what a computer processes and what a human sees do not always have to be identical.
That can create opportunities to hide instructions, disguise text or interfere with automated security analysis.
For everyday users, this is another reason not to trust a message simply because the visible text looks normal.
Links deserve particular attention. Rather than judging a link by how it appears in an email, open the legitimate service yourself when the request concerns a sensitive account.
The broader lesson is that attackers increasingly exploit the gap between human perception, software parsing and automated security controls.
Security is therefore becoming less about spotting one obvious bad spelling and more about verifying the actual destination and context.