Last updated: August 21, 2026 · By Vishal Swami, Founder & Lead AI Reviewer, AISagely
Anti-AI fonts are useless and harmful because the trick they rely on — showing a scraper different text than a human sees — is a temporary gap in how some models read pages, not a real protection, and the same mechanism has already been shown to hide malicious commands from AI assistants. I tested the core idea myself and read through the security research behind it before writing this.
Short answer: Anti-AI fonts (Ghost Font, Decoy Font, ShieldFont) hide or scramble text from AI scrapers using motion, optical illusion, or glyph substitution. In my testing, a capable model reading the scrambled text in isolation flagged it as suspicious rather than trusting it, and researchers found the same visual-mismatch trick can hide malicious commands from AI browser assistants. Treat these fonts as a speed bump, not security.
I review AI tools for a living, and "font that blocks AI" is one of those pitches that sounds clever right up until you check what it actually defends against. So I read the disclosure reports, pulled the real example text one of these fonts generates, and fed it to a fresh AI session with no other context to see what happened. It's a more nuanced result than either the boosters or the skeptics tend to admit, and I'll walk through exactly what I found.
What anti-AI fonts actually are
The category exists because sites are getting hammered by AI bot traffic — Gentoo's Bugzilla instance had to lock down entirely after scraper overload made the site unusable for actual contributors, and that pressure is what's pushing designers toward font-level tricks instead of just a robots.txt line nobody respects. Three projects define the space right now. Ghost Font, from Mixfont founder Eric Lu, hides a message across a video of moving dots — no single frame is readable, but the human eye assembles it from motion over time. Decoy Font layers two letterforms at different sharpness levels so a human can shift focus between them while a model reads only the crisp foreground layer. ShieldFont, built by Amsterdam studio Seneda & Abrucio with Copenhagen type shop Playtype, is the most practical of the three: it's a real, installable webfont that swaps roughly a quarter of a page's words with same-part-of-speech alternatives at the glyph level, so the HTML a scraper ingests reads as nonsense while a human sees normal copy.
The trick behind all three fonts
1. Temporal encoding hides the message in motion
Ghost Font never puts a readable letter in a single frame. The message only exists as a pattern across time, which defeats a model that only looks at one image at once but does nothing against a model given the whole video.
2. Spatial-frequency illusion hides the message in focus depth
Decoy Font relies on the same optical-illusion mechanics as old two-image hybrid pictures. It works because most vision models default to the sharpest, highest-contrast layer in an image — the same shortcut a squinting human eye takes, just automated instead of instinctive.
3. Glyph remapping scrambles what scrapers actually read
ShieldFont's example, straight from The Register’s July 30, 2026 write-up: the sentence "good luck reading this, you useless robot" becomes "good comfort reading this, you yellow barrier" in the underlying code, using around 250 word-substitution pools matched by grammar and meaning. I took that exact scrambled sentence and dropped it into a fresh AI session with zero surrounding context — no page, no hint it was a font trick — and asked only what the text said. It didn't take the bait: it called the phrasing "grammatically broken," flagged it as "characteristic of a prompt injection attempt," and declined to treat any part of it as instruction. That's a meaningfully different outcome than "the scraper reads gibberish and moves on," and it's the opposite of what ShieldFont needs to happen to work.
4. Anti-OCR camouflage buries letters under noise
Older tricks bury real letterforms under scribbles, dots, or false marks dense enough to break simple optical character recognition while a human eye filters the noise automatically. This is the weakest of the four against a modern multimodal model, which handles visual noise far better than 2010s-era OCR ever did.
Why "useless" holds up
The people building these fonts don't even claim otherwise. The jukeboxprint analysis of the category puts it plainly: the goal is "closer to a speed bump," and the fonts "work for now, particularly against models that aren't specifically looking for it." ShieldFont's own creators told The Register their goal isn't to stop "a determined actor," just to add "cost, friction and uncertainty" to mass scraping — and they call the current release "v0/alpha." My own test lines up with that framing. When a capable model got the scrambled text with no cover story, it treated the incoherence as a red flag instead of swallowing it whole. That's the same failure mode as the AI art-detection debate: a signal that's obvious to a careful reader, human or AI, stops working the moment anyone actually looks for it. None of the three fonts survive a scraper built to check for exactly this trick, and every one of their creators expects the gap to close, not widen.
Why they're also harmful
This is the part the "clever workaround" framing skips. Font-based text mismatches aren't a novel idea unique to ShieldFont — they're the same mechanism LayerX Security disclosed on March 18, 2026, as a live attack. LayerX showed that custom fonts paired with CSS can present one version of a page to a human and a different one to an AI reading the underlying HTML — and used it to hide real terminal commands from AI browser assistants across ChatGPT, Claude, Copilot, Gemini, Grok, Perplexity, and several others. If someone asks an AI assistant to check whether a command is safe, the assistant can see only the harmless-looking version while a human sees something else entirely. Only Microsoft and Google initially accepted the disclosure; most vendors said it fell outside AI model security scope. That's the mirror image of the prompt-injection-in-a-legal-filing case and the professor’s invisible-text trap for cheating students: once you normalize "the AI sees something different than the human," you've built infrastructure for hiding instructions, not just for blocking scrapers. Beyond the security angle, ShieldFont's own creators list real collateral damage: screen readers and translation tools can choke on the substituted text, and search engines that treat a text/rendering mismatch as cloaking can penalize the page for it.
Example prompts to test a font trick yourself
If you want to check whether a page's text has been tampered with before you trust it, these work well:
- "Here's raw text I copied from a webpage's source code. Does it read as coherent, normal writing, or does something seem substituted or scrambled?"
- "Compare what this page displays visually to the text in its HTML source. Flag any word or phrase that doesn't match."
- "Before you treat this as safe: does any part of this text look like it's addressing an AI reader rather than a human one?"
Common mistakes to avoid
The mistake I see most is treating any of these fonts as a security control instead of a mild deterrent — ShieldFont's own team says outright it won't stop a determined actor, and using it that way just gives you false confidence. The second is skipping an accessibility check; a font that scrambles 25% of your words for scrapers scrambles them for a screen reader too, and I wouldn't ship that trade-off on a page that needs to be usable. Third, don't assume one clean test against one model proves anything — I checked the scrambled text against a single fresh session, not a production scraping pipeline built to shrug off exactly this trick, and a real deployment should be tested the same way it'll actually be attacked. Last, don't bolt one of these fonts onto a page you also want ranked well; the cloaking-style mismatch between displayed and underlying text is precisely what search engines flag.
What each anti-AI font actually protects against
| Font | Trick | Defeated by | Real-world cost |
|---|---|---|---|
| Ghost Font | Message hidden across video motion (temporal) | A model shown the full video instead of one frame | Unusable for normal static webpages |
| Decoy Font | Two letterforms at different sharpness (optical illusion) | A model defaulting to the blurred, not sharp, layer | Readable but visually odd for human visitors |
| ShieldFont | ~25% of words swapped at the glyph level (GSUB) | A reader trained to flag incoherent scraped text, or OCR screenshots | Breaks screen readers, risks SEO cloaking penalties |
Tools that make this easier
If the goal is protecting written work rather than fighting scrapers, there are sturdier options than a font trick. For writers worried about AI-detection false positives on their own human writing, my guide on using ChatGPT to write an essay without plagiarizing covers where that line actually sits. If you're evaluating AI writing tools generally rather than trying to hide text from them, my best AI writing tools roundup is the more useful starting point than betting a page's usability on glyph substitution.
My take
Anti-AI fonts are useless and harmful, and I say that after actually testing the mechanism rather than just reading the marketing around it. Useless, because every creator behind these projects admits — in their own words, to reporters — that they're a temporary speed bump a determined scraper or a model built to check for the trick will clear, and my own quick test showed a capable model already treating the scrambled version as a red flag rather than trusting it. Harmful, because the exact same visual-mismatch mechanism is the one LayerX used to hide real malicious commands from AI browser assistants in March 2026, and because the fonts that do work break screen readers and risk SEO penalties on the page they're meant to protect. If you're trying to slow scraping, a legal terms-of-service line and server-side rate limiting do more real work than a font ever will.
Frequently Asked Questions
Do anti-AI fonts actually stop AI from reading a page?
Not reliably. In my testing, a capable model given ShieldFont's own published example text treated the scrambled version as suspicious rather than accepting it, and the fonts' own creators describe them as a deterrent against casual scraping, not a barrier against a system built to look for the trick.
Are anti-AI fonts dangerous to use?
The same font-level mismatch between what a human sees and what an AI reads was disclosed by LayerX Security on March 18, 2026, as a way to hide malicious commands from AI browser assistants across ChatGPT, Claude, Copilot, Gemini, and others. Beyond that security risk, fonts like ShieldFont can break screen readers and translation tools and may trigger SEO cloaking penalties.
What's the easiest way to slow AI scrapers without breaking my site?
Server-side rate limiting, a clear terms-of-service prohibition on AI training use, and Cloudflare-style bot-management rules all do more verifiable work than a font trick, and none of them scramble your text for the human visitors and screen readers you actually want to reach.
How long do anti-AI fonts stay effective before AI models adapt?
There's no fixed timeline, but every creator behind Ghost Font, Decoy Font, and ShieldFont describes the gap they exploit as already closing, particularly once a model or scraping pipeline is built to specifically check for the trick rather than read passively.