The provenance of this finding is the part worth an hour of a security leader's attention. The hunting logic was built for email-borne cross-prompt injection, content that reads as harmless but carries hidden instructions for whatever model ingests the raw message, and the same hunt became the starting point for the phishing discovery [3]. That is not a lucky tool reuse. Both attacks lean on one property of the Unicode Tags block: characters that software processes and people never see [7]. Microsoft's own framing is that the intent is inverted while the mechanism holds, with the tag characters either smuggling instructions into a model or obscuring keywords before a detector evaluates them [14]. One signature, written once, covers two threat classes that most orgs fund from different lines.
The board-deck version of that is "AI security research pays for itself in phishing defence," and it is incomplete. Microsoft says the majority of the messages were flagged by layered protections rather than by any single Unicode-specific signal [5]. On the blocking question, then, the new signature was close to marginal; what it bought was visibility. That is the trade-off to price honestly, because visibility work is front-loaded and unglamorous. The first version flagged any code point in the range and was too blunt, firing on legitimate mail that turned out to contain the England, Scotland and Wales flag emojis, which are themselves encoded with tag characters [9]. There are 128 code points in that block [11], and the useful signature is the one that knows which of them are innocent.
After those exclusions, the residual hits were mostly gateways, mailbox providers and researchers forwarding test traffic [10]. That tedious baseline is the entire reason a spike was legible at all: hits rose sharply from February 9, 2026 and stayed elevated on weekdays for roughly three months, running to about early May [4][12]. The weekday shape is consistent with an operation run to a work schedule rather than dumped in one burst, though the telemetry as published supports no stronger reading than that [4].
A skeptic would say this is one vendor's telemetry, one campaign, and existing filters caught most of it. On the blocking claim that is fair, and the record here is single-sourced: Microsoft reporting on its own product [5]. The record does not say who ran the campaign, how many messages moved, whether other providers saw the same February spike, or what the evasion actually bought in delivery. What it does establish is the direction of reuse, from AI red-teaming write-ups and conference talks through 2025 [8] into a high-volume commodity phishing run against keyword parsers [1][2].
So the decision this quarter is narrow and organisational. Whoever writes your rules for handling the U+E0000 range in the mail gateway [6] should be the same people writing them for the assistant that reads the mailbox, because the character range is identical and only the target of the deception differs [14].
