GHOST FONT HID TEXT FROM AI FOR 19 MINUTES

Nineteen minutes. That is how long ChatGPT 5.5 Pro spent staring at Eric Lu's Ghost Font before it hallucinated a message that was never there. A rival model needed one minute and fifty six seconds to read the same video correctly. The gap was not raw intelligence. It was one sentence someone typed describing how the trick worked.

Ghost Font is a typeface built to hide text from AI while staying fully readable to a human eye, and this week it proved something more useful than the trick itself. The distance between a model that hallucinates and a model that reads is one accurate sentence about mechanism, not more compute.

Eric Lu Built A Font That Moves

Type a few characters into Ghost Font and the site does not render a static image. It renders a video. Every pixel that forms a letter slides uniformly in one direction while every background noise pixel slides the opposite way. No single frame contains a readable outline of any letter. A human brain groups the moving pixels through optical flow, the same visual system that lets you spot a deer in dense woods because it moves while the trees do not. The word appears only across time, never in a still.

AI vision models fed the same footage see something closer to television static. Most are built to reason about a frame or a short stack of frames, not to track consistent pixel motion the way a retina does by default. Lu, working on Ghost Font as an experiment, exposed a gap between how humans and machines actually see rather than how they are usually compared on a benchmark.

The Decoy Is Built For Agents With Code

Lu added a second layer of protection that targets a specific kind of attacker: an AI agent with a local code execution environment. Every Ghost Font video hides a decoy message alongside the real one. An agent that thinks to analyze pixel motion programmatically tends to decode the decoy first, then confidently report a successful decryption that is wrong. It is a trap built for exactly the tool a capable AI agent would reach for on its own.

ChatGPT 5.5 Pro walked straight into that gap. Across 19 minutes of analysis, it never touched the decoy or the real message. It produced a third answer, one that does not appear anywhere in the video. That is not a wrong guess. It is a hallucination with 19 minutes of apparent reasoning behind it, the exact failure mode that makes AI output dangerous to trust unchecked, a risk Anthropic has been pricing directly into how Claude Fable 5 gets released and pulled back.

Riley Goodside Beat It In One Sentence

The break came without code, without an agent framework, without a multi step reasoning chain. Riley Goodside told GPT 5.6 Sol exactly how the animation worked. The letter pixels slide upward. Everything else slides downward. Sol read the hidden text in one minute and fifty six seconds. The message was RILEY WAS HERE.

That is not proof GPT 5.6 Sol is smarter than 5.5 Pro in general. It is proof that a model told the mechanism stops guessing and starts measuring. The same model family is already shipping into daily workflows through ChatGPT Work, which bundled GPT 5.6 and Codex into a free tier this month. A trick that survives 19 minutes of blind analysis can die in under two minutes once someone hands over the instructions instead of the puzzle.

This Is A Prototype, Not A Captcha Yet

Lu is floating two real uses for Ghost Font: a CAPTCHA that verifies a human is watching motion rather than typing distorted letters, and a benchmark for testing whether an AI system actually understands video or just stitches frames together and guesses. Neither exists as a shipped product today.

What already exists is proof of an expiration date. Adversarial tricks built for one generation of models do not stay unreadable once the method goes public, and Ghost Font's method is now public, cracked, and quoted. The lock in question here is not a subscription price or a habit loop. It is how long a visual trick stays unreadable once someone simply describes what it is doing. For Ghost Font, that number was measured in hours, not months. Watch what Lu builds next, because the CAPTCHA version of this idea will only work until the first person types the mechanism into a chat window.