{
  "id": 6674399,
  "title": "When the code you're reviewing isn't what the model wrote",
  "url": "https://urgent.news/2026/09/11/when-the-code-youre-reviewing-isnt-what-the-model-wrote",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-11T00:15:03.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cole_halton_42f71d71b809b/when-the-code-youre-reviewing-isnt-what-the-model-wrote-1ejl"
  },
  "original_language": "en",
  "account": "When conducting AI code reviews, I examine the differences between versions as plain text. The tool performs the same action. This discrepancy creates a gap that ASCII smuggling exploits. Microsoft has identified this issue, where ASCII smuggling, initially used in cyberattacks, is now employed by spammers to bypass email filters. A Unicode character like U+E0041 appears as a regular \"A\" to humans but carries hidden data, while email filters only see the plain text. This phenomenon also affects AI code reviews. When an AI reviewer examines a code patch, it reads the sanitized-looking diff instead of the actual code in the repository. If the line includes an invisible Unicode character, the reviewer perceives it as a standard ASCII character and overlooks the discrepancy. This deception is not just theoretical; it has real-world implications for evaluating AI-generated code. The issue lies in the fact that two strings differing only in invisible codepoints receive identical scores, allowing malicious content to pass unnoticed. To address this, before feeding a diff to an AI reviewer, it is essential to normalize the input by either stripping or flagging all characters outside a strict set of allowed printable ASCII characters (including language-specific non-ASCII characters like accented characters). By performing this normalization step before the AI model processes the code, the entire class of attacks that exploit invisible codepoints can be eliminated. Reviewers who claim to review AI code without scrutinizing the raw bytes they are given are essentially reviewing a narrative about the code rather than the code itself. Implementing this simple check and fix during the intake phase can significantly reduce the occurrence of sneaky prompts and protect the integrity of AI code reviews.",
  "summary": "When I review AI-generated code, I read the diff as text. The tool does the same. Which is exactly the gap ASCII smuggling slides through. Microsoft just flagged that ASCII smuggling, the trick once aimed at attacking AI, is now being used by spammers to get invisible text past email filters. A Unicode tag character like U+E0041 renders as a normal \"A\" to humans and passes thin text filters,…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}