Humans won once, but AI struck back in a day—the viral "Ghost Font" was cracked with a single sentence

Humans barely "won" a round, only to get outplayed by AI in less than a day!

Here's what happened: Developer Eric Lu released a video titled "Ghost Font".

The video went viral immediately after its release.

It racked up over 17 million views overnight.

It's an "anti-AI font" experiment that uses dynamic noise videos to render text: type a few characters on the webpage, and the system generates a video where the pixels forming the letters all slide upward uniformly, while the background noise all slides downward uniformly.

The human eye instantly understands it through motion perception.

But when AI views the video frame by frame, all it sees is static snow noise.

Eric directly tested the two most powerful current models: Claude Fable and GPT-5.6 Sol Ultra.

Both failed completely — both models confidently claimed to have decoded the information, but what they read were all decoy texts deliberately embedded by the author, not even coming close to the real hidden message.

GPT-Sol 5.6 Ultra attempted to decode a message written in Ghost Font. The model read the hidden decoy message but failed to capture the actual motion-based message.

It's extremely easy to try it out yourself: type a line of text on the webpage, download the generated noise video and send it to a friend — humans can read it directly with their naked eyes, while AI is completely stumped. A secret message that only humans can receive is created this way.

Link: https://www.mixfont.com/ghost-font

The entire process runs locally in the browser, no data is sent to any server, and no information is leaked externally.

Why can humans instantly understand it while AI is clueless?

The human eye has an innate instinct, known in psychology as the Gestalt "common fate" principle: when a group of points moves in the same direction, you automatically perceive them as a unified whole. Just like a flock of geese flying in a V-shape in the sky, you don't need to identify each bird individually — the shape registers in your mind immediately.

Ghost Font leverages exactly this principle: letters are made of pixels sliding upward, while the background noise slides downward — your visual cortex, which evolved its motion perception capabilities over millions of years, completes the separation in 0.1 seconds.

But once you pause the video, all pixels blend together, and every single frame shows pure noise. Screenshots are useless, and frame-by-frame analysis also yields nothing.

Screenshot

Current multimodal models are essentially "image models wrapped in a video shell": even when you feed them a video, they break it down into individual frames to analyze separately, like taking a movie, splitting it into thousands of still frames, and examining each one slowly.

They simply don't "perceive motion". Ghost Font exploits this exact gap in their capabilities.

Decoys: A Trap Built Exclusively for AI

Even more cleverly, Eric Lu added a second layer of protection: every video contains an embedded decoy message.

This trick is specifically designed to counter Agents with local code execution environments — even if they think to analyze pixel motion, they will most likely hit the decoy first, then confidently stop their work and solemnly report that "decryption is successful".

ChatGPT 5.5 Pro spent a full 19 minutes struggling, before finally hallucinating a completely non-existent message, not even reading the decoy correctly.

Someone tested it with Gemini 3.1 Pro, and the model earnestly replied: SEND NUDES — this was exactly the decoy content deliberately embedded by the author.

Even when Claude Fable was set to Max reasoning mode, it was no use — it still fell into the decoy trap and confidently output the wrong answer.

Claude Fable attempted to decode a message written in Ghost Font using Max reasoning. The model read the hidden decoy message but failed to capture the actual motion-based message.

It seemed like humanity had safeguarded its last cipher.

But that safeguard only lasted a single day.

Broken With One Sentence

Prominent prompt engineering expert Riley Goodside stepped in.

He wrote no code, built no multi-step reasoning chains, and used no fancy Agent frameworks — he only said one single sentence to GPT-5.6 Sol:

The noise pixels forming the letters slide upward, while all other pixels slide downward.

Just this one direction hint. Sol took 1 minute and 56 seconds, then read out the correct answer: RILEY WAS HERE.

One single sentence, not even a complete prompt, pierced through the entire "exclusive to humans" barrier.

Another person fed ChatGPT 5.6 two screenshots taken 1.5 seconds apart, and told it "the background is moving at a constant speed" — the model directly performed pixel difference analysis, and the letters emerged clearly.

This demonstrates that AI is not incapable of perceiving motion; it simply does not default to thinking in that direction. Once given a nudge, the so-called barrier of "human intuition" is as thin as a sheet of paper.

ZXX Lasted Ten Years, Ghost Font Lasted One Day

This scene has played out once before in history.

In 2013, Sang Mun, a former NSA contractor and Korean-American designer, released the ZXX font family, which included six variants — camouflaging letters with patterns, noise, strikethroughs and fake markers, specifically designed to defeat OCR optical character recognition.

Back then, this tool was hailed as a "surveillance-immune miracle", with CNN and Salon rushing to cover it, and the design community embracing it as a manifesto against surveillance.

But today, if you feed an image of ZXX to ChatGPT 5.5, it reads all the text in a single query, not missing even the smallest fine details. Thirteen years of "surveillance immunity" became a trivial, easy-to-solve problem for modern AI.

ZXX lasted ten years, while Ghost Font only lasted one day.

The Real Question Ghost Font Explores

So what Ghost Font is truly asking is — how far is AI's perception still behind that of humans?

The harsh answer is: It's just one prompt away.

Just think about CAPTCHAs. Current CAPTCHA systems have basically been completely defeated by AI, and dynamic verification once looked like a promising escape route — machines couldn't understand it, while humans could pass it at a glance.

But Goodside has just proven that one single sentence can teach AI to "perceive moving objects". How far this escape route can go is now a big question mark.

Then think about how we test AI.

We have always been using static images for tests, and barely ever evaluated their "motion perception" capabilities. If a full set of dynamic vision exams were created one day, most current models would probably turn in blank papers collectively.

Of course, this loophole also has an expiration date. Native multimodal models that can directly understand full videos will arrive sooner or later — at that point, understanding motion will no longer be a skill that requires human prompting, but something the model can do inherently.

Eric Lu says he plans to open-source Ghost Font, hoping that in an era where AI takes over everything, humanity can still retain a little creativity that belongs exclusively to itself.

How many more days will the next "only humans can understand" thing last?

References:

https://x.com/ericlu/status/2075876651574210643 - https://x.com/goodside/status/2076361122328858829

Editor: Solomon

This article is from the WeChat public account "AI Era", author: ASI Revelation, published with authorization by 36Kr.