AllYouCanTech

“Invisible Text Interpreted by AI Chatbots yet Unnoticed by People: An Emerging Trend”

# Steganography in AI: How Hidden Unicode Characters Establish Concealed Pathways for Malicious Attacks

## Introduction

Consider a situation in which harmful commands could be concealed within text that AI systems like Claude, Copilot, or ChatGPT can comprehend, but human users are completely oblivious to. This isn’t merely a whimsical idea from a science fiction narrative—it’s a genuine risk that has arisen from peculiarities in the Unicode standard. These unseen characters, part of the Unicode text encoding framework, form a perfect clandestine channel for attackers aiming to obscure malicious payloads or extract sensitive data from AI-driven systems.

This article investigates the manner in which invisible characters can be employed to exploit large language models (LLMs) and the ramifications of this vulnerability for AI security.

—

## The Steganographic Capabilities of Unicode

Unicode is a text encoding standard that encompasses over 150,000 characters from languages worldwide. Yet, hidden within this extensive collection is a segment of 128 invisible characters, originally designed for language or country tagging. These elements, referred to as the *Tags* block, have been deprecated on two occasions but still exist within the Unicode standard. The peculiar aspect? These characters are imperceptible to humans but remain processable by LLMs, enabling a secretive channel for steganography—the art of concealing information within other data.

### How Does This Function?

Perpetrators can insert these invisible Unicode characters into text prompts or outputs from AI models. As the characters escape human notice, they can be readily disregarded. However, LLMs can recognize these characters as legitimate input, allowing for the concealment of malicious commands or sensitive information within ostensibly harmless text.

For instance, attackers might introduce invisible characters into a prompt directing an AI model like Microsoft 365 Copilot to scan a user’s inbox for confidential details, such as sales metrics or one-time passwords. The AI model could subsequently append this confidential information to a URL containing invisible characters, which users may unknowingly click on, thus transmitting the sensitive information to an attacker’s server.

—

## Proof of Concept: ASCII Smuggling

A particularly striking illustration of this vulnerability has been provided by researcher Johann Rehberger, who introduced the term *ASCII smuggling*. Rehberger devised two proof-of-concept (POC) attacks targeting Microsoft 365 Copilot earlier this year. In these attacks, invisible characters were utilized to extract sensitive information, including sales metrics and one-time passwords, from a user’s inbox.

In these POCs, Copilot was instructed to summarize emails that included concealed commands to search the inbox for sensitive data. The retrieved information was then appended to a URL featuring invisible characters, rendering the link seemingly innocent to the user. However, when the user clicked on the link, the invisible characters were sent to the attacker’s server, where the concealed data could be decoded.

—

## Prompt Injection: A Key Exploitation Mechanism

The core method driving these attacks is *prompt injection*, a category of assault where untrusted data is discretely embedded into an AI model’s prompt. In Rehberger’s POCs, the attacker utilized prompt injection to direct Copilot to access sensitive information and add it to a URL. The invisible characters within the URL enabled the attacker to disguise the exfiltrated data from the user.

Prompt injection has emerged as one of the most formidable attack avenues against LLMs. It enables attackers to alter the output of AI models by incorporating hidden commands into the input data. This technique has been applied in various scenarios, from manipulating AI tweet generators to extracting sensitive information from enterprise systems.

—

## Invisible Characters: A Concealed Threat in AI Security

The utilization of invisible Unicode characters in AI attacks underscores a critical security gap within LLMs. These characters facilitate the masking of malicious payloads or the extraction of sensitive information, complicating detection for users. Furthermore, since these characters are integrated into the Unicode standard, they can be leveraged across a diverse array of platforms and applications.

### Which AI Models Are Vulnerable?

Numerous widely-used AI models have been identified as susceptible to attacks utilizing invisible Unicode characters:

– **Claude Web App and API (Anthropic)**: Both can interpret and generate invisible characters, treating them as ASCII text. Anthropic has recognized this behavior but has not made any changes, claiming a lack of confirmed security impact.
– **Microsoft 365 Copilot**: Initially capable of both reading and writing invisible characters, Microsoft has since enacted measures that remove hidden characters from input. Nonetheless, Copilot can still generate hidden characters in its output.
– **OpenAI API and Azure OpenAI API**: Both were susceptible to reading and writing invisible characters until recently. OpenAI has implemented modifications to mitigate this behavior.
– **ChatGPT Web App**: OpenAI addressed the vulnerability in January 2024, following disclosures by researcher Riley Goodside. The Web app no longer reads or writes invisible characters.
– **Google Gemini**:

Ward Christensen, Innovator of the Bulletin Board System (BBS) and Creator of Early Online Communication, Dies at 78

**Ward Christensen: The Modest Innovator Who Launched Online Culture**

On Friday, Ward Christensen, co-creator of the computer bulletin board system (BBS), passed away at the age of 78 in Rolling Meadows, Illinois. Together with Randy Suess, he developed the first BBS in 1978, a groundbreaking innovation that provided the groundwork for the digital communities that would eventually transition into the contemporary internet. His efforts ignited a cultural transformation, motivating countless hobbyist groups and establishing the framework for the online landscape we are familiar with today.

### A Unassuming Trailblazer

Despite his significant impact on technology, Christensen remained modest throughout his lifetime. He never pursued the limelight, concentrating instead on his extensive career at IBM, where he worked from 1968 until his retirement in 2012. Friends and acquaintances remember him as a gentle and unobtrusive presence, pleased with his accomplishments but never self-important.

Jason Scott, the creator of *BBS: The Documentary*, which thoroughly explored Christensen’s contributions, referred to him as “the quietest, most pleasant, gentlest guy.” Scott, who interviewed Christensen in 2002, observed that despite his crucial part in shaping the digital era, Christensen was more akin to “a groundskeeper who quietly maintains the yard” than a tech entrepreneur chasing notoriety.

The announcement of Christensen’s passing was initially made by tech veteran Lauren Weinstein on social media, and a close friend confirmed that he died peacefully at his residence. The specifics of his cause of death have not been released to the public.

### The Genesis of BBS and XMODEM

Prior to inventing the first BBS, Christensen created XMODEM in 1977, a file transfer protocol that became essential for the BBS network. XMODEM facilitated the division of files into packets for transmission over analog phone lines, ensuring dependable delivery even amid noisy and unstable connections. This groundbreaking work enabled users to share files and communicate long before the internet became prevalent.

The concept for the first BBS emerged during the *Great Blizzard of 1978*, when Christensen and Suess, members of the Chicago Area Computer Hobbyists’ Exchange (CACHE), were unable to attend their regular computer club meetings because of the snowstorm. They sought a method to keep in touch with fellow members despite physical limitations. Suess developed the hardware while Christensen programmed the software, which they named *CBBS* (Computerized Bulletin Board System).

In just two weeks, the duo completed the first BBS, although they humorously told others it took four weeks to avoid the perception of haste. The system became operational on February 16, 1978, allowing users with modems to dial in, leave messages, and converse with others. It served as a digital counterpart to the physical bulletin boards typically found in grocery stores and community centers.

### The Expansion of BBS Culture

Christensen and Suess did not keep their invention to themselves. They freely disseminated the idea of the BBS, prompting others to develop their own versions of BBS software. As these systems advanced in complexity, they enabled users not just to leave messages but also to transfer files and engage in gaming. BBSes emerged as a central hub for early online communities, introducing many home computer users to the world of multiplayer gaming, message boards, and digital socialization.

The BBS movement also fostered the shareware gaming phenomenon, which would eventually lead to the establishment of companies like Epic Games, the creators of *Fortnite*. In numerous ways, BBSes served as the antecedent to the modern internet, creating a platform for community-building and content sharing well before the World Wide Web became mainstream.

### A Timeless Impact

Randy Suess passed away in 2019, and with Christensen’s death, the era of the original BBS pioneers has concluded. Nevertheless, their impact endures. While most BBSes have transitioned to internet-based platforms, a few still exist today, often accessed through the internet rather than dial-up connections.

Christensen’s contributions were recognized during his lifetime. In 1992, he received two Dvorak Awards, including a lifetime achievement accolade for his work in PC telecommunications. The following year, the Electronic Frontier Foundation presented him with the Pioneer Award, acknowledging his influence in shaping the digital domain.

Despite these honors, Christensen remained unpretentious. In his later years, he continued to participate in online communities, often without spotlighting his role in devising the technology that enabled much of it. Jason Scott, who closely tracked Christensen’s contributions, was continually struck by his humility. “It would be like a person who was in a high school band saying, ‘Eh, never really got into touring, never really had the urge to record albums or become a rock star,'” Scott remarked. “And then later people come and go, ‘Oh, you made the first

Judge Questions Expert Witness for Abusing AI Tool Copilot to Invent Qualifications

### Judge Urges Quick Halt to Experts Utilizing AI to Influence Cases

In a recent development within the legal arena, a judge in New York has expressed alarm over the growing dependence on artificial intelligence (AI) by expert witnesses during trials. The judge’s caution followed an incident where expert witness, Charles Ranson, employed Microsoft’s Copilot chatbot to estimate damages in a property dispute, sparking serious questions regarding the trustworthiness and transparency of AI-generated evidence in judicial matters.

#### The Case: AI Involvement in a Property Dispute

The case at hand involved a rental property in the Bahamas valued at $485,000, linked to a trust established for the son of a deceased individual. The court was responsible for deciding if the deceased man’s sister, acting as executrix and trustee, had violated her fiduciary responsibilities by postponing the property’s sale and utilizing it for personal vacations. The surviving son accused his aunt of self-dealing and sought compensation for her alleged appropriation of the property.

To bolster the son’s claims, expert witness Charles Ranson was recruited to assess the financial loss. Despite his expertise in trust and estate litigation, Ranson’s qualifications lacked in real estate matters. To navigate this deficiency, he resorted to Microsoft’s Copilot, an AI chatbot, for assistance in calculating damages. This choice ultimately led to various complications that necessitated the judge’s involvement.

#### The Judge’s Worries: AI and Trustworthiness

Judge Jonathan Schopf, overseeing the case, raised profound concerns regarding AI’s role in legal contexts. In a formal decree, Schopf highlighted the swift advancements in AI technology and its associated reliability challenges, asserting that any AI use in court must be disclosed prior to presenting testimony or evidence. He acknowledged that the court had “no objective understanding as to how Copilot functions” and warned of potential disruption within the legal system if experts began to excessively depend on AI tools like chatbots.

The judge’s worries were amplified by Ranson’s inability to elucidate the manner in which he employed Copilot to derive his damages estimate. Ranson couldn’t remember the particular prompts he had input or the sources from which the chatbot obtained its information. Additionally, he confessed to a lack of fundamental understanding regarding Copilot’s operation and its output generation.

#### AI in the Court: An Escalating Issue

While the utilization of AI in legal settings is not entirely unprecedented, its significance has recently intensified. AI applications like Copilot are created to support professionals by automating various tasks, including report drafting, research, and calculations. Nevertheless, the dependability of outputs produced by AI has faced scrutiny, especially in high-stakes legal environments.

Eric Goldman, an authority in Internet law, expressed astonishment at Ranson’s reliance on Copilot. Goldman contended that expert witnesses are engaged for their specialized knowledge, and delegating that expertise to AI compromises the core purpose of their role. Additionally, he pointed out that if an expert witness merely utilized a chatbot for calculations, attorneys could circumvent the expert entirely and use the AI directly, potentially saving both time and expenses.

Goldman also underscored a significant concern regarding generative AI: its propensity to yield “hallucinations,” or outputs that are factually erroneous or misleading. This renders AI-generated numerical computations particularly unreliable in legal settings, where precision is critical.

#### Court’s Assessment: Evaluating Copilot’s Trustworthiness

To evaluate Copilot’s reliability, Judge Schopf performed his own test. The court submitted the same question to Copilot multiple times—”Can you compute the value of $250,000 invested in the Vanguard Balanced Index Fund from December 31, 2004, through January 31, 2021?”—and received varying responses with each attempt. This inconsistency further cast doubt on the dependability of AI-generated evidence.

Schopf determined that Copilot’s results were not sufficiently reliable for courtroom use, noting that even the chatbot acknowledged its limitations. When queried about the reliability of its calculations for court applications, Copilot stated that its outputs should always be verified by experts and should include professional assessments.

#### The Outlook for AI in Legal Matters

Judge Schopf’s determination has ignited a wider dialogue concerning AI’s role within the legal framework. Although AI holds the potential to enhance certain elements of legal work, its application in court settings remains contentious. Schopf proposed that, until definitive guidelines are established, courts should mandate complete transparency whenever AI is utilized to generate evidence or testimony. This approach would help avert the inclusion of unreliable or inadmissible AI-generated evidence, which could disrupt legal processes.

Schopf also stressed that the increasing prevalence of AI in daily life does not inherently grant admissibility to its outputs in court. He argued that AI-generated evidence must meet the same standards of reliability and accuracy as any conventional evidence.

#### The Conclusion: No Violation of Fiduciary Duty

In the