ASCII Smuggling Goes Mainstream as Enterprise AI Security Hits $1.2B

Two years ago, ASCII smuggling was a niche concern discussed mainly by AI red-teamers experimenting with prompt injection attacks on large language models. Today, Microsoft Defender for Office is logging more than 2.5 million detections of the technique per day, spammers have adopted it wholesale, and the venture capital community is betting billions that the security infrastructure enterprises currently rely on simply cannot cope. The timing is not a coincidence.

The underlying logic connecting these stories is straightforward. The same properties that made ASCII smuggling useful for hijacking AI agents, specifically the ability of Unicode tag characters to be read by machines but remain invisible to humans, make it equally useful for defeating the machine-learning spam classifiers that now guard most corporate inboxes. Attackers found a single exploit and discovered it works against two distinct categories of AI system. Meanwhile, the enterprise AI platforms now being funded at unicorn valuations are expanding the attack surface every month.

How ASCII smuggling moved from AI labs to spam campaigns

ASCII smuggling works by substituting standard characters for Unicode tag-block equivalents, for example U+E0041 in place of a plain "A". Email filters tokenise text before evaluating it, and inserting an invisible U+E0020 into the middle of the word "funding" may cause a classifier to read "fun" and "ding" instead. The human recipient sees nothing unusual. According to Microsoft's own reporting, detections via Microsoft Defender for Office jumped from roughly 21,000 per day in early February to 2.5 million within four days, before falling sharply in mid-May. The spike suggests attackers tested, iterated and scaled quickly, treating the AI-era spam filter as a new class of model to be gamed rather than a static rule set to evade.

Glow's $1.2B bet on AI-native endpoint security

Into this environment steps Glow, a Tel Aviv and Palo Alto startup that emerged from stealth with $180 million in Series A funding, a $1.2 billion valuation, and a pitch that existing endpoint security tools are structurally unfit for an AI-saturated workplace. Founded by Roi Tiger, a former Facebook vice president of engineering, Glow deploys specialised AI agents that run on Glow's own central servers rather than on endpoint devices, continuously mapping the environment and making real-time decisions about which software should be permitted inside a business. The funding round was led by Sequoia, Cyberstarts, Greenoaks and Redpoint Ventures. Glow says it already has enterprise customers in healthcare, retail and financial services, though it has not named them. The central claim is that AI makes prevention at enterprise scale viable for the first time, rather than the reactive, detect-and-respond model that has dominated for years.

Wonderful's $5B AI OS raises the governance stakes

At the same time, Wonderful, an Amsterdam-headquartered startup founded in 2025, closed a $550 million Series C at a $5 billion valuation, led by Insight Partners with participation from Salesforce. The company has moved from deploying customer-service agentic AI to selling what it calls a full AI OS, a platform that coordinates agents, workflows, AI-native applications and governed execution across an entire organisation. Wonderful says its OS works with any underlying model and does not require customers to rebuild their stack when they switch. That flexibility is commercially attractive, but it also means enterprises running Wonderful will be processing untrusted content through LLMs at scale, precisely the scenario in which ASCII smuggling-style prompt injection attacks are most dangerous. The more capable and interconnected these platforms become, the more consequential a successful injection attack against them would be.

What buyers of enterprise AI tools should watch for now

For anyone currently evaluating platforms like Wonderful or endpoint security products like Glow, the ASCII smuggling story is a practical checklist item, not a theoretical concern. Any AI system that ingests email, documents or customer messages should be tested for Unicode tag-block handling. Ask vendors whether their classifiers perform OCR-style visual rendering of content before evaluation, because a system that does not is potentially blind to this class of attack. Glow's server-side agent architecture means individual devices do not carry the processing burden, but it also means detection must happen centrally before malicious content reaches the model. The $1.2 billion and $5 billion valuations in this week's funding news reflect genuine market demand, but they also reflect how much ground there is still to cover before enterprise AI deployments can be considered reliably secure.