Someone Built a Font Only Humans Can Read. AI Cracked It in a Day.

TL;DR

For about a day, it looked like humans had finally built something a frontier model could not do: write a message that any person can read but an AI cannot. Made by Eric Lu of Mixfont, Ghost Font renders your text as a short video of drifting dots. Any single frame is pure noise. Only motion, played back in a browser, resolves the dots into letters, and your eyes do it automatically. It went viral, some 15 million views in a day, and both GPT-5.6 Sol Ultra and Claude Fable 5 failed to read it, confidently reporting a decoy message instead. Then, less than 24 hours later, it was cracked. Not with a new model, but with a single sentence.

How a message hides in motion

Ghost Font's trick is temporal. It encodes each letter as a cluster of dots that only line up while the video plays. The letter-forming dots drift one way while the background dots drift the opposite way, and the human visual system, which spent a few million years learning to pick a moving predator out of moving grass, fuses those opposing flows into words without any effort. Freeze the video and the effect collapses: the dots scatter back into what looks like television static, because in any one frame they carry no shape at all. It is the inverse of one of those spinning-fan LED clocks, where a row of blinking lights spells the time only while the blades whirl and looks like nothing when stopped. Here the message lives entirely in the movement between frames.

There is a second layer built for machines specifically. Every clip carries a decoy message that is easy to detect, so a model asked to find the hidden text grabs the bait and announces it with high confidence. And because everything renders locally in your browser, nothing about your message ever touches a server.

Why the frontier models whiffed

The failure was not a lack of raw intelligence, it was a blind spot in how these models look at video. A frontier multimodal model does not watch a clip the way you do. It samples a handful of still frames and reasons over each one as an image. When every sampled frame is noise, frame-by-frame analysis has nothing to grab, so the model does exactly what it was trained to do on images: it finds the most legible, salient pixels, which is the decoy, and reports those. It never computes how the dots move between frames, because optical flow is not its default way of seeing. That is the gap Ghost Font was designed to exploit, and on day one it worked cleanly.

The counter-attack, in one sentence

Then the internet did what the internet does. According to a report from 36Kr, prompt-engineering figure Riley Goodside cracked it almost immediately, and not by training anything. He handed GPT-5.6 Sol a single directional hint: "the noise pixels forming the letters slide upward, while all other pixels slide downward." One minute and fifty-six seconds later the model read the message back: "RILEY WAS HERE," which is roughly the AI-vision equivalent of spray-painting your name on humanity's last exclusive wall.

A second tester skipped the model's video handling entirely, feeding ChatGPT two screenshots taken 1.5 seconds apart with the note that the background moves at a constant speed. That is enough to trigger pixel-difference analysis across the two frames and pull the letters straight out. Researchers pointed out the same thing can be automated with classic computer vision: a few lines of OpenCV phase correlation subtract the moving background and the message pops right out, no neural network required.

The real lesson, and why it keeps happening

The most quoted line from the whole episode is also the most important: AI is not incapable of perceiving motion, it simply does not default to thinking in that direction. Ghost Font did not find a wall in machine vision, it found a habit. The models can reason across frames and compute motion perfectly well; they just do not do it unprompted, because their training rewards reading the clearest pixels in front of them. Point them at the temporal dimension with one sentence and the human-only barrier evaporates.

That pattern has a history. Back in 2013 a designer built ZXX, a typeface scrambled with dots and strikethroughs to defeat the optical character recognition of the era. It was clever, it was beautiful, and today any frontier model reads it without breaking stride. Ghost Font is the same story compressed from a decade into a day. Anti-AI obfuscation aimed at one specific model weakness ages about as well as a password written on a whiteboard.

None of which makes Ghost Font pointless, and it does surface something that matters. Plenty of systems quietly assume machine vision now equals human vision: CAPTCHAs, browser agents clicking through the web on your behalf, content filters, security gates. Docker founder Solomon Hykes put the sharp end of it in one line while watching the demo, "captchas are about to get so much worse." The useful takeaway is not that you can hide from AI. It is that the difference between what humans and machines perceive is real, shallow, and closing fast, and anyone betting a security control on that gap is renting an advantage, not owning it.

Key Takeaways

• Ghost Font, by Eric Lu of Mixfont, hides a readable message inside dot motion: every still frame is noise, only playback resolves the letters, and a decoy layer misleads AI. It all runs locally in the browser.
• On launch it beat frontier models. GPT-5.6 Sol Ultra and Claude Fable 5 both reported the decoy, because they sample frames independently and never compute motion between them.
• It was cracked in under a day. Riley Goodside decoded it with a single directional hint in 1m56s; two screenshots 1.5 seconds apart, or a bit of OpenCV phase correlation, also work.
• The lesson is a default-reasoning gap, not a capability gap. Prompted toward motion, the models see it fine.
• The 2013 anti-OCR font ZXX is now trivially readable; anti-AI obfuscation targeting a known weakness has a short shelf life. Anything assuming human-parity machine vision (CAPTCHAs, browser agents, security gates) should take note.

Sources: Mixfont: Ghost Font, 36Kr (how it was cracked), Developers Digest (mechanism and ZXX), ExplainX (viral reach and reactions), Remio