Threat Intel

1M+ Emails Use Hidden Text to Dupe AI Security Filters

Over one million phishing emails reportedly bypass AI-driven filters by injecting invisible characters — a technique that exploits how LLMs tokenise text and could hit any organisation relying solely on AI-based email defence.

Summary written by editorial AI · Source link below

Filed by Dark Reading16 July 20261 min readRead at source ↗

Artificial intelligence and LLMs can be surprisingly ineffective against text salting, allowing phishing emails to slide right into your inbox.

Editorial Analysis

Why it matters

Enterprises investing heavily in AI-based email security may carry unrecognised residual risk; text-salting shows that adversarial evasion of LLM classifiers is practical and already at scale.

What to do

Audit your email gateway's handling of Unicode normalisation and supplement AI-based filtering with rule-based checks for invisible character injection.

Board brief

AI email filters can be bypassed at scale using simple text manipulation, highlighting the need for layered defences beyond AI alone.

Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.

Continue at the source

Read the full report at Dark Reading

External link — opens at Dark Reading in a new tab.

Continue with

Editorial Analysis

More from the Threat Intel Desk