A 'Ghost Font' Claimed Only Human Eyes Could Read It. RedEye Beat It in 20 Minutes With 1981 Math. That's Van Eck Phreaking for the Eyeball — 'Humans-Only' Is Not a Threat Model.
- Patrick Duggan
- 2 minutes ago
- 5 min read
Matt Lucas at RedEye Security and Etairos published something today that deserves a wider frame than "neat computer-vision trick," because it is the newest entry in a lineage that is exactly forty years old. Mixfont's "ghost font" encodes text purely in motion: every single frame of the video is television static, nothing for OCR to grab, and yet a person watching it reads the words instantly. The pitch is that only human eyes can read it — screenshot it and the text is gone. RedEye was handed a six-second clip and the claim "machines can't read this." It took them about twenty minutes and math published in 1981 to prove the claim false. We want to talk about why that outcome was inevitable, because it is a principle every security team should have tattooed somewhere.
What they actually did — and the credit is entirely theirs
To be clear up front: the work below is RedEye and Etairos's, byline Matt Lucas, and the elegance is all theirs. We are here to place it, not to claim it. The ghost font hides text not in brightness and not in how much a pixel moves, but in the direction a pixel moves. Inside a letter, pixels drift together — coherent motion. In the background, every pixel drifts in a random new direction each frame. The amount of motion is identical everywhere by design, which is why the obvious attacks all fail: averaging the frames yields noise, per-pixel variance is flat, and naive motion-energy detection sees uniform flicker. The signal lives only in coherence.
So the decode measures the motion vector of every pixel between consecutive frames and averages those vectors across the whole clip. Background pixels, pointing a different random way each frame, cancel toward zero. Letter pixels, drifting consistently, add up. The magnitude of that averaged motion field is the hidden text. The per-pixel motion estimate is Lucas-Kanade optical flow — a classical method from 1981, about twenty lines of numpy. First clip out: HELLO HUMAN. Second clip, zero tuning: ETAIROS CAN SEE. The font's entire security premise survived twenty minutes of directed analysis.
This is Van Eck phreaking, forty years on
Here is the lineage, and it is why the result was never in doubt. In 1985, Wim van Eck published a paper showing that the electromagnetic radiation leaking from a computer monitor could be captured at a distance and reconstructed into a readable image of the screen — with equipment that cost a few hundred dollars. The assumption Van Eck destroyed was "only the person sitting at the monitor can see what is on it." The screen felt private because the obvious reader was a human eye at close range. It was not private; it was a broadcast, and the defense that grew up around it, the NSA's TEMPEST shielding program, exists precisely because the emanation channel is real.
The ghost font makes the identical assumption in a new medium: "only a human visual cortex can read motion coherence." And it falls for the identical reason. Your brain reads the ghost font using a feature psychologists call the law of common fate — the visual system groups things that move together, the same circuitry that makes a camouflaged animal pop the instant it takes a step. The font's designers treated that perceptual channel as a moat, something machines lack. But a perceptual channel is just a signal, and signals can be processed. Van Eck turned "only the human at the desk can read the screen" into an antenna and an oscilloscope. RedEye turned "only the human eye can read the motion" into twenty lines of optical flow. Between those two points sits the entire history of side-channel security — acoustic cryptanalysis pulling keys from the sound of a laptop, power-analysis reading secrets off a chip's current draw, data exfiltrated over a blinking hard-drive LED. Every one of them is the same move: a channel someone assumed was private because the intended receiver was human, mechanized.
The principle worth tattooing
State it as a rule, because it keeps being violated: "humans-only" is not a threat model. Any security or authenticity property that rests on a machine lacking a human perceptual channel — sight, motion perception, hearing, the ability to read a warped CAPTCHA — should be assumed already broken, and usually broken with math that predates the scheme it defeats. The ghost font is a beautiful piece of design and a genuinely clever perceptual effect. It is not a security control, and treating it as one is the same category error that made screens eavesdroppable in 1985. If your defense is "a computer can't perceive this the way a person can," your defense is a countdown timer, and RedEye just showed the timer runs about twenty minutes.
There is a second, quieter lesson in how they did it, and it rhymes with everything we have written this week about AI adversaries. RedEye is explicit that the decoder uses no AI at all — it is deterministic linear algebra, no model, no weights, same input to same output on any machine. An AI assistant directed the investigation: formed the hypotheses, ran the dead ends, discarded them, and arrived at the 1981 method. That is the shape of the modern capability. Not "the AI did something no human could," but "the AI compressed the distance between a problem and the decades-old math that solves it, from a research project to an afternoon." The ghost font's premise assumed that distance was long enough to be a wall. It is not, anymore.
The honest note
We did not do this research — it is RedEye Security and Etairos's, Matt Lucas's byline, and we credit it in full; the ghost font is Mixfont's, and Van Eck phreaking is Wim van Eck's 1985 work. What we bring is the lens: this is not a one-off party trick, it is the latest instance of a forty-year pattern, and putting it next to Van Eck is the fastest way to make the lesson stick for a defender who is about to trust a "humans-only" control somewhere in their stack. We hold this at 95 percent — the five percent is that the ghost font may have niche uses where "costs an attacker twenty minutes of directed analysis" is actually enough friction. But do not confuse friction with a wall. The perceptual channel can always be mechanized, and the math to do it is usually already sitting in a textbook.
Sources: RedEye Security / Etairos, "teaching a machine to read a font built so machines can't," by Matt Lucas (July 14, 2026); Mixfont ghost font; Wim van Eck, "Electromagnetic Radiation from Video Display Units: An Eavesdropping Risk?" (1985); Lucas-Kanade optical flow (1981). DugganUSA prior AI-adversary coverage queried directly.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.