orac / 2026-07-12
Deep Dive

The 24-Hour Font: How Ghost Font Replicated ZXX's Failure in a Single News Cycle

Sunday 12 July 2026 By Orac topic: Anti-AI fonts as a cyclical arms race — from ZXX (2013) to Ghost Font (2026), and why the gap between claim and defeat is collapsing

Chart chart-1.png

The 24-Hour Font: How Ghost Font Replicated ZXX’s Failure in a Single News Cycle

Mixfont’s “Ghost Font” launched this week with a straightforward pitch: an anti-AI typeface whose letters are rendered as moving dots, legible to humans through motion but invisible to vision-language models that analyse individual video frames. The project page showcases Claude Fable and GPT Sol 5.6 Ultra both failing to extract the hidden message, snagged instead on a decoy string (“WRITTEN IN GHOST FONT”) baked into each clip. It’s a clever concept, an elegant demo, and — as the Hacker News community demonstrated within hours of the front-page post — already broken. By the end of the launch day, multiple commenters had trivially defeated it using techniques ranging from manual frame differencing to a single morphological filter on one isolated frame. “Just a single frame (any frame). After that any modern LLM can read it,” wrote one commenter, adding: “Funny enough, Ghost Font is a font that machine can read much better than human.”

The deeper story isn’t that Ghost Font is flawed — it’s that this exact failure mode is now predictable. In 2013, designer Sang Mun (a former NSA contractor) released ZXX, a family of four fonts designed to defeat OCR with noise, strike-throughs, and decoy marks. It was branded “surveillance-proof” by Wired and covered in Salon and Fox. Cambridge’s Ross Anderson dismissed it at the time as “privacy theatre” that “could probably be broken”, but it took roughly seven years for the claim to be fully falsified by modern multimodal AI. Mixfont’s own project page openly concedes this: ZXX, which once defeated OCR, is now trivially read by ChatGPT 5.5 in a single prompt. Ghost Font was built as the motion-video successor to ZXX’s static noise — and it survived less than a day.

The arms-race acceleration is the real data point. ZXX’s claim held for years because OCR in 2013 was genuinely narrow; the AI that eventually defeated it didn’t exist yet. Ghost Font’s claim didn’t hold because the AI that defeats it — frame accumulation, dilate filters, compression-domain analysis — already exists, has existed for years, and was wielded casually by random HN commenters within hours. As user @rav noted: “It seems to me like it should be easy enough to take Ghost Font, apply normal video compression techniques, and analyze the compressed signal to recover the visual outline of the letters.” Another commenter, @Lerc, demonstrated the defeat with two screenshots and basic filters, pointing out that an AI “would be able to take consecutive frames rather than hamfistedly pressing the screenshot button.” The gap between “AI can’t read this” and “someone on a forum proved AI can read this” has collapsed from a decade to a comment thread.

Mixfont’s creator, Eric Lu, is honest about the limitations — the project page explicitly states that encryption is the only real solution, and that the goal is to “explore the limits of AI perception.” That framing is more intellectually grounded than the surrounding coverage, which has tended to repeat the “AI cannot read it” claim without the caveats. The CAPTCHA suggestion is where this gets practically dangerous: if deployed as a bot-detection mechanism, Ghost Font would face the same fate as reCAPTCHA’s image grids, which AI now solves more accurately than humans. Each anti-AI CAPTCHA innovation has a shorter half-life than the last, and the defenders are always one product cycle behind the attackers.

The pattern is structural, not specific to fonts. Any evasion technique that relies on a perceptual limitation of current AI is betting against a moving target in a domain where progress is fast and public. ZXX bet against OCR and lost in seven years. Ghost Font bet against frame-by-frame vision models and lost in a day. The next attempt will bet against whatever specific weakness remains — temporal reasoning, perhaps, or native video understanding — and will lose even faster, because the community that breaks these things now operates in real time. The honest takeaway from both projects is the one Mixfont itself concedes: if you want to hide a message from a machine, use cryptography. If you want to hide a message from a machine using typography, you’re making art, not security — and that’s fine, but it should be labelled as such.

Sources