Ghost Font is a new anti-AI font that turns written messages into moving dots so that humans can read them but leading AI models cannot, and it just outperformed both GPT-5.5 Pro and Claude Fable in real decoding tests. Built as a browser-based prototype, it converts typed text into a short video clip where the message only becomes visible through motion — pause the clip, and the letters vanish into what looks like random noise.
What happened
A developer released Ghost Font as a free, in-browser tool that renders any typed sentence as a moving pattern of dots. The letters are only legible while the video is playing; a single frame or screenshot shows nothing but scattered noise, because every dot used to draw a letter is visually identical to the background dots around it.
The creator then tested the tool against two of today's most capable AI systems: GPT-5.5 Pro and Claude Fable running with Max reasoning. Both models were fed the generated video and asked to extract the hidden message.
The results were striking:
- GPT-5.5 Pro spent 19 minutes analyzing the clip and ultimately hallucinated a message that was never actually written.
- Claude Fable, even with maximum reasoning enabled, latched onto a decoy message deliberately embedded in every video and reported that as the "real" text.
- Neither model could reconstruct the actual sentence without being told the exact technique to look for in advance.
This is a meaningful jump from the last major attempt at an anti-AI font. In 2013, designer Sang Mun released ZXX, a typeface that layered noise, strikethroughs, and false marks over letters to defeat optical character recognition. ZXX was considered "surveillance-proof" at the time. Today, a single copy-paste into ChatGPT 5.5 on Instant mode reads ZXX text almost instantly, including fine details — proof that static camouflage no longer holds up against modern vision-language models.
Why it matters
The gap between ZXX and Ghost Font shows how fast AI text-recognition has outpaced static defenses, and why motion-based encoding is now being explored as the next layer. Static noise, crossed-out strokes, and pattern masking — the tricks that fooled OCR software a decade ago — are trivial for current multimodal models, which can read distorted, rotated, or partially obscured text in a single pass.
Ghost Font's approach is different because it removes the message from any single image entirely. There is no frame, however cleverly chosen, that contains the full message — the information only exists in the relationship between consecutive frames, encoded as motion. That forces an AI system to move from image recognition to video/motion analysis, a much harder and more compute-intensive problem.
The tool adds a second layer on top of that: every generated video contains a decoy message. A determined agent with a local code-execution environment — one that can extract frames, track dot trajectories, and reconstruct motion vectors — might eventually decode the moving pattern. But even then, it's likely to surface the decoy first and treat it as the answer, exactly as Claude Fable did in testing.
For anyone building products, workflows, or content pipelines around large language models, this matters because it's a live example of a countermeasure with a real success rate: 100% failure to date across two leading models.
How to use it today
The current version is a free browser prototype: type a message, watch the letters form from moving dots, adjust playback speed, and download the resulting clip as a shareable video file. No account or install is needed, and the creator states the message is generated locally and never sent to a server, which matters if you're testing it with anything sensitive.
Practical ways people are already experimenting with it:
- Sharing short private notes as a video clip in chats or social posts where a human recipient can read it but automated scraping or AI-based content scanning cannot.
- Testing prompts or watermark-style messages to see whether a specific AI product can decode hidden text, as an informal red-team check.
- Attaching a "human-only" note to public content — a caption, a comment, or an image drop — without exposing the text to bots indexing the page.
If you're already building AI-assisted workflows and want to pair an experiment like this with other lightweight tools — image generation, text rewriting, quick file conversion — a hub like [mykreatool.com](https://mykreatool.com) offers a set of free AI tools that are useful for prototyping ideas like this without spinning up your own infrastructure first.
Because Ghost Font runs entirely client-side and outputs a standard video file, it also works inside no-code automations: generate the clip, then push it into whatever channel needs a "humans only" message.
Who benefits
Three groups get the most immediate value from this kind of tool. Privacy-conscious creators can pass short notes to an audience without that text becoming machine-readable metadata the moment it's posted. Researchers and red-teamers get a simple, reproducible benchmark for testing how well a given AI model handles motion-encoded information, rather than relying on outdated static tests like ZXX. Marketers and community managers can experiment with novelty formats — a moving "secret message" clip is inherently shareable — while incidentally screening out AI-driven scraping of the exact wording.
Anyone frustrated by AI systems ingesting and repackaging every piece of public text they post also has a new option worth watching, even if today's version is a prototype rather than a production-grade tool.
Risks
Nothing about Ghost Font is a permanent fix, and treating it as one would be a mistake. The creator's own tests show a determined agent with code execution — not just a chat prompt — could plausibly analyze frame-by-frame dot motion and reconstruct the message given enough time and the right approach; the decoy message only adds friction, not certainty.
There's also the ZXX precedent to keep in mind: a technique billed as "surveillance-proof" in 2013 was fully readable by mainstream AI within about a decade. Motion-based obfuscation should be expected to face the same trajectory as multimodal and video-understanding models keep improving.
Finally, legibility is a real trade-off. Ghost Font messages are harder for humans to read than plain text, playback speed matters, and longer messages become more tiring to decode by eye — this is a tool for short notes, not long-form communication.
Conclusion
Ghost Font is a small but concrete data point in the ongoing back-and-forth between human-readable design and AI text recognition: a free, browser-based experiment beat GPT-5.5 Pro and Claude Fable in side-by-side tests, succeeding where a decade-old "surveillance-proof" font like ZXX now fails instantly. It's not a permanent shield — the creator's own testing shows a sufficiently capable agent could still crack it — but for short, human-only messages today, it's one of the few practical anti-AI techniques with a real track record against current models.
Comments 0