The moment to picture is on the review side. A flagged message gets opened, an agent reads a flat paragraph of sales copy, finds nothing wrong with it, and clears the queue. What the agent read and what the model behind the queue read were not the same string, because those tag characters render as nothing in most interfaces and travel as text regardless [6].
Here is what users actually do with a text box: they paste. Resumes, ticket bodies, product blurbs, notes lifted out of a CRM, all of it bytes from somewhere else. Here is what teams tell themselves users do: type characters that match what renders on screen. The moment a model or a rules engine sits behind that box, the assumption stops being cosmetic and becomes a control you do not actually have.
The surface is at least countable. The Unicode standard defines code points for roughly 150,000 characters and has capacity for more than a million [2], and the Tags block accounts for 128 of those [3]. Work the division and it comes to about 0.09 percent of what is currently defined [10]. Deciding whether a sentence contains a malicious instruction is a semantics problem; deciding whether a code point falls inside a fixed range of 128 is a table lookup.
The false-positive budget is small as well. A commenter in the Ars thread notes that the block's surviving sanctioned use is as a flag-emoji modifier, where the sequence gbwls yields the Wales flag, and calls that use rare and not well supported [7]. Another reader wants the choice kept local, writing "Give me the option to turn it on and I will" [9]. What the material does not do is quantify how much spam is using the technique, name the filters it is getting past, or show any provider shipping that option [13].
Ingest is also the only place the fix holds. A reader in the same thread sketches the escalation: make the entire payload tag characters, wrap it in HTML and JavaScript, and let a few lines of script shift everything back into the ASCII range once the message is open [12]. A keyword scanner reading the delivered bytes finds nothing to match. A normalizer that drops the block at the door removes the payload before any script has something to rebuild.
The useful sort is two columns wide: the places where a human reads a rendered string, and the places where a machine acts on it. Where one input lands in both columns, the display path and the decision path have to agree on the bytes, which means normalizing at the boundary and logging what got removed, so that on Friday somebody can tell a customer which invisible characters bounced their message.
