Ghost Font is a new experimental typeface, released this week and already on the Hacker News front page, that encodes text so a person can read it while today's AI models cannot. The trick is that Ghost Font is not a still image at all: it is a short looping video whose letters are built from dots colored to match the background, so any single frame looks like random noise and only human vision, which fuses the frames over time, resolves the words.

  • It weaponizes a real gap in machine vision. Multimodal AI reads one frame at a time, so a screenshot of Ghost Font contains no legible text, because the message lives across frames rather than in any single one.
  • It even plants a decoy. A fake message is embedded to catch a determined AI agent, so a model hunting for hidden text finds the decoy and stops before reaching the real one.
  • Its 2013 predecessor already fell. The ZXX font was built to defeat OCR, but modern models like ChatGPT now read ZXX in a single prompt, which is exactly why Ghost Font moved from static glyphs to motion.
  • It is an art statement, not encryption. The creator is explicit that real secrecy still needs a key; Ghost Font explores the limits of AI perception rather than promising security.
How Ghost Font hides text from AI but not from humans Ghost Font is a looping video whose letters are made of dots that blend into the background. Human vision fuses the successive frames over time and reads the words, while an AI model that samples a single frame sees only random dots plus a planted decoy message. HUMAN VS MACHINE PERCEPTION Ghost Font: a looping video of dot-noise frames your eyes fuse the frames HUMAN reads the hidden words a model grabs one frame AI MODEL sees dots + a decoy genztech.blog
Fig 1 Ghost Font encodes its message across video frames; human vision integrates them into words, while a single-frame AI reading returns only noise and a planted decoy.

How does a font hide text from AI but not from you?

Ghost Font, built by designer Eric Lu and hosted on mixfont.com, throws out the assumption that a typeface is a static shape. Its message is delivered as a short looping video, and every letter is composed of small dots colored to match the background. Any single still frame, the exact thing an AI model captures when it reads an image, therefore contains nothing but scattered noise. The word appears only when the frames play in sequence and a human visual system integrates them over time, the same persistence-of-vision effect that turns still frames into a movie. Current multimodal models do not watch, they sample: feed one a screenshot and it sees dots. Lu goes one step further and plants a decoy, a fake hidden message baked into the file so that a determined agent searching for concealed text finds the decoy, concludes it has solved the puzzle, and stops before reaching the real payload.

RelatedOpenAI puts GPT-5.6 Sol on Cerebras wafer-scale silicon

Why did the older anti-AI font stop working?

This is not the first typeface designed to be illegible to machines, and the history is the whole point. In 2013 designer Sang Mun released ZXX, a set of four fonts scrambled with noise, strike-throughs, and false marks specifically to defeat optical character recognition and the surveillance it enables. For years it worked. It does not anymore. Modern multimodal models read ZXX in a single prompt, small details included, because they were trained on messy real-world text and are far more robust than the OCR pipelines of a decade ago. That collapse is exactly why Ghost Font abandons static glyphs for motion. A still image, however scrambled, is now solvable, so the defense moved into the one dimension a single-frame reader cannot access, which is time.

  1. 2013Sang Mun releases ZXX four OCR-proof typefaces built to dodge machine reading and surveillance
  2. 2023-2025Multimodal AI defeats ZXX models like ChatGPT read the once-unreadable font in a single prompt
  3. Mar 2026Font-rendering attacks surface researchers show custom fonts that hide malicious text from AI web assistants
  4. Jul 2026Ghost Font goes viral a motion-based typeface reaches the Hacker News front page

Is this a gimmick or does it actually matter?

On its surface Ghost Font is an art statement, and Lu is refreshingly honest that it is not security. True secrecy, he notes, still needs encryption and a key no model can guess. But the underlying idea, a measurable gap between what a person perceives and what a machine perceives, is being taken seriously well beyond typography. Lux Capital co-founder Josh Wolfe amplified the project on X, calling it wild and arguing that illusions unique to human biology may prove more useful than anyone expected, though for now that read rests on the demo itself rather than a formal paper. The serious version already has consequences: in March 2026 researchers showed that custom fonts and CSS can visually transform text so a human sees a benign page while the underlying document, and any AI assistant reading it, sees hidden instructions, a technique usable to slip malicious commands past AI defenses.

Who actually cares about a font only humans can read?

Two camps, pulling in opposite directions. For artists, privacy advocates, and anyone who wants to publish something machines cannot trivially scrape, index, or summarize, a human-only channel is appealing on principle, a small reassertion of a capability the last few years of AI seemed to erase. For security teams the same trick is a threat, because the perception gap that keeps a message human-only also lets an attacker hide a prompt injection or a phishing lure from the very AI moderator meant to catch it. That is the uncomfortable symmetry of every anti-AI obfuscation method: the mechanism that protects a well-meaning author is identical to the one that shields an attacker, and defenders have to reason about both at once.

RelatedClaude Cowork vs ChatGPT Work: the agent app war goes mobile

What to watch · 2026
  • The obvious counter. Video models that sample many frames and reconstruct motion would read Ghost Font the way people do; expect someone to demo exactly that within weeks.
  • The dual-use flip. The same perception gap lets attackers hide prompt-injection or phishing text from AI moderators while humans see something benign. That is the version security teams should track.
  • The short half-life. Anti-AI obfuscation ages fast. ZXX lasted a decade against OCR and days against multimodal models; motion tricks will have even less time.

Our take

Ghost Font is the most elegant demonstration in years of a simple fact the AI hype cycle keeps papering over: machine perception is not human perception, and the seams are still visible if you look for them. The move from static camouflage to motion is genuinely clever, and the built-in decoy shows real understanding of how an agent actually searches. It will not last, and Lu clearly knows it. A video model that samples many frames and reconstructs motion would read this the way we do, and someone will almost certainly demo that within weeks, just as multimodal models quietly retired ZXX. The lasting value is not the font as a lock, it is the font as a probe: a cheap, public test of where a model's vision ends and ours begins, and a reminder that those two things are not yet the same.

Primary sources

Original analysis by GenZTech. Project: Ghost Font on mixfont.com.