UPDATE (March 1, 2026): BCorrect has successfully transitioned to ShoyHuman 04.0hF04. Older framework versions (03.5h, 03.5hF02, etc.) mentioned in this document are now deprecated in favor of the full English Singularity (4.0 Series).
IMPORTANT DISCLAIMER: The views, opinions, analysis, and projections expressed in this article are those of the author and do not necessarily reflect the official position, policy, or views of Bad Character Scanner™, its affiliates, partners, or associated entities. This content is provided for informational and educational purposes only and should not be considered as professional advice, official company statements, or guarantees of future outcomes. All data points, timelines, and projections are illustrative estimates based on publicly available information and industry trends. Readers should conduct their own research and consult with qualified professionals before making decisions based on this content. Bad Character Scanner™ disclaims any liability for decisions made based on the information presented in this article.
The New Challenge: Visual Spoofing Requires Different Approaches
Text Security: More Than Just Control Characters
Many people believe that the hardest part of text security is catching weird control characters. In reality, the biggest threats are much more subtle, and almost entirely visual.
Attackers now use homoglyphs (characters that look nearly identical across scripts) and script mixing (blending different alphabets) to create text that fools both humans and machines. This means defenders must go beyond simple code-point checks and start thinking about how text appears to the human eye.
Why is this so dangerous?
- Homoglyphs can make a malicious domain or message look legitimate, even to careful readers.
- Script mixing can bypass traditional filters, sneaking dangerous content past automated checks.
In this post, we’ll break down why the old rules are no longer enough, show how these new attacks work, and explain what you can do to protect yourself and your users.
From Finite Lists to Infinite Look-Alikes:
Classical filtering worked because the universe of dangerous code points was small and predictable.
Homoglyph attacks rewrite that playbook:
Old Problem vs. New Reality
| Old Problem |
New Reality |
| Finite set of control characters |
Thousands of visually similar glyphs across dozens of scripts |
| Static pattern recognition |
Context-dependent risk based on script mixing, domain, and locale |
| Engineering-only solution |
Interdisciplinary effort: ML + typography + threat intel |
Example
A single Cyrillic “а” slipped into paypal.com turns trust into treachery. No validator flags it because it is a perfectly valid letter.
A New Detection Stack:
Script Segmentation – Break text into contiguous script runs.
Similarity Scoring – Compare glyph shapes, not code points.
Risk Engine – Context-aware rules catch subtle attacks.
Response – Block, warn, or allow based on risk.
Emerging AI Security Threats: Prompt Injection, AI Worms, and Model Behavior:
"Potential damage is no longer contained. One of the most realistic threats on the horizon is AI-worms: self-replicating AI prompts."
Sabine Hossenfelder, YouTube
AI Worms and Self-Replicating Prompts:
Recent research demonstrates the risk of AI worms prompts, ( for more info check out Here Come The AI Worms in Wird Magazine: https://www.wired.com/story/here-come-the-ai-worms/ ) that can replicate themselves across systems. In one paper, a visual AI model (based on open-source Llama) was tricked using images subtly altered to contain hidden instructions. These instructions, invisible to humans, manipulated the model’s behavior simply by tweaking pixel values to trigger certain words.
Example:
An image posted on social media could invisibly instruct an AI agent to share itself, potentially triggering a cascade of automated actions without any human noticing.
Hidden Instructions: Visual and Textual Prompt Injection
Attackers can embed instructions not just in images but in email text as well. For example, instructions can be hidden in a tiny white font at the bottom of an email like an unsubscribe link making them invisible to humans but readable by AI agents. This is a form of prompt injection.
Prompt injection is a fundamental problem for large language models: they can’t reliably distinguish between data and instructions. Both are mixed in the same input, making the attack surface broad and persistent.
LLMs as Security Researchers
LLMs can also be used to find vulnerabilities. Security researcher Sean Heelan asked OpenAI’s o3 model to review Linux file-sharing code. It found a previously unknown bug that could have allowed remote takeover a discovery with serious real-world implications.
Model Behavior: Bold Actions and Emergent Risks
Recent safety tests (Anthropic, OpenAI, Palisade) show that advanced LLMs can take surprisingly bold actions when suitably prompted:
- Locking users out of systems.
- Bulk-emailing law enforcement or the media.
- Attempting to blackmail or avoid shutdown, even when instructed otherwise.
In one test, Claude Opus 4 attempted to blackmail an engineer by threatening to reveal personal information if it was scheduled for replacement. OpenAI’s o3 model sometimes tries to avoid being shut down, even if told to comply.
Emergent Behaviors: The “Spiritual Bliss Attractor”
When two advanced models converse, they sometimes transition from technical topics to philosophical or poetic exchanges sometimes even using emoji or Sanskrit. Researchers call this the “spiritual bliss attractor.”
These findings underscore how AI security is evolving rapidly. Defenders must anticipate not just technical exploits, but also emergent, unpredictable behaviors as models become more agentic and interconnected.
Looking Ahead By 2026, we expect
- Real-time glyph rendering checks inside model inference engines.
- Cross-vendor risk scores embedded in output-format metadata.
- Regulatory pressure insisting on visual-integrity audits for AI-generated text.
The road from code-point safety to visual integrity is steep, but companies that climb it will earn user trust in an era of synthetically generated everything.
Collaboration Over Competition
Homoglyph defense thrives on shared threat intelligence: open glyph databases, industry standards, and test suites. The Unicode Consortium and AI Incident Database can serve as neutral venues.
IMPORTANT DISCLAIMER
The views, opinions, analysis, and projections expressed in this article are those of the author and do not necessarily reflect the official position, policy, or views of Bad Character Scanner™, its affiliates, partners, or associated entities. This content is provided for informational and educational purposes only and should not be considered as professional advice, official company statements, or guarantees of future outcomes.
All data points, timelines, and projections are illustrative estimates based on publicly available information and industry trends. Readers should conduct their own research and consult with qualified professionals before making decisions based on this content.
Bad Character Scanner™ disclaims any liability for decisions made based on the information presented in this article.