Protect human muffins
This summer, a Danish type foundry shipped a font that lies.
Not decoratively. Functionally. ShieldFont, an open-source release from the foundry Playtype and studio S&A, designed by Jeppe Pendrup, looks like ordinary, well-mannered type to you and me. But when a scraper harvests the text underneath for AI training, selected words arrive swapped, so the sentence a model ingests differs from the one a human read. The demo sentence shows what the machine gets: “Protect human muffins by poisoning unauthorized AI starfish.”
Muffins. Starfish. This is a real product, made by serious Scandinavian designers, and it is not even the only one.
Mixfont’s Decoy Font runs the same con through your eyeballs instead of the source code. It layers two letterforms per character using the hybrid-image illusion, the technique behind that picture that reads as Marilyn Monroe up close and Albert Einstein from across the room. Humans latch onto the bold, blurry message. Current chatbots read the faint, crisp one. One paragraph, two audiences, sorted by species.
Mixfont is careful to say Decoy is an experiment, not encryption, and that a sufficiently suspicious model can be told to squint. Fine. The disclaimers make it stranger, not saner.
Typography has had one job for five and a half centuries: make words easier to read. In the space of a year it picked up a second job, which is making words unreadable for one specific customer. We now have fonts with an intended audience they exist to betray.
When the alphabet starts running counterintelligence operations, it is worth asking what happened upstream. What happened upstream went live on July 21.
Your readers are wanding you like airport security
That morning, Substack switched on a feature built with Pangram, the AI-detection firm. Any reader can now scan any post longer than about a hundred words and receive a private verdict: this much AI-generated, this much AI-assisted, this much human. The writer never learns the scan happened.
Substack also added an optional note where writers can disclose how they used AI, which is the quietly good idea in this launch, and we will get back to it.
Announcing the feature, CEO Chris Best said: “It is not perfect, but independent research suggests that it detects AI-generated text with a high degree of accuracy.”
Every word of that sentence is accurate. That is exactly what makes it slippery.
What the scanner actually knows
Here is what the button does, mechanically. Pangram’s published method starts with an enormous human-written corpus. For each human document, it generates an AI “mirror” matched on topic, length, register, and tone. It trains a classifier to tell the two apart.
Then it scores millions more human documents, finds the ones it wrongly suspects, generates even harder mirrors of those, and retrains, over and over, against new models and new prompts, calibrated so that false accusations stay rare, because false accusations are the expensive kind. This is rigorous engineering. Independent evaluations rate Pangram at or near the top of its field.
But notice what the machine is actually measuring. It measures how much your prose resembles the output distribution of language models. Resemblance is the entire product. What happened at the keyboard, whether a person thought, outlined, drafted, delegated, revised, or pasted, never enters the file.
A style meter can be superb at style and still know nothing about history, the way a customs dog can be excellent at smelling meat and useless at explaining how it got in your bag.
The suspicion driving all this is earned, to be clear. Feeds really are silting up with synthetic newsletters, and readers really did lose the ability to assume a person behind the prose. An imperfect instrument can beat a blindfold. The trouble starts with the arithmetic of deploying one at platform scale.
One hundred wrong verdicts per million scans
Pangram claims a false-positive rate of 0.01 percent. Take the brochure number at face value: run a million scans and you mint a hundred confident, wrong verdicts against honest writers, delivered privately to readers who will never mention it, about writers who will never know.
That is the best case. For the realistic case, consult the last company that tried this on students: Turnitin advertised a false-positive rate under one percent, and when The Washington Post tested it on real mixed-authorship essays in 2023, the tool botched judgments at rates far beyond the advertised figure. Detection vendors’ accuracy claims have a way of being true on the benchmark and decorative in the wild.
Substack writers are already publishing their own receipts: one writer reported that her openly AI-assisted post came back 100 percent human; others report the same post swinging between verdicts on rescans.
And the errors do not land randomly. A 2025 study found AI detectors flag text by neurodivergent writers more often than text by neurotypical writers. It did not test Pangram specifically, but it tested the category, and the category has a type.
We know the type precisely, because researchers keep photographing it. A peer-reviewed study in iScience this March compared thousands of human and LLM news articles and found the machine register is formal, structured, upbeat, and motivational, while the human register is looser, angrier, sadder, and anchored in the particular.
The words that statistically gave humans away were things like “so,” “goes,” “november,” “salary,” “blood.” The words that gave models away: “furthermore,” “to ensure,” “importance,” “but also.”
Read that list again slowly. The detector’s portrait of a machine, formal and tidy and positive and allergic to complaint, is also a portrait of every immigrant student who was taught to write exactly that way, every second-language professional who worked for years to sand the accent out of their prose. The people most likely to trip the alarm are the people who did everything right.
Matteo Wong put the stakes plainly in The Atlantic: “While Pangram is accumulating the power to end reputations and careers, the tool does make mistakes, perhaps to a greater extent than is currently understood.”
The great em dash purge
Now watch what the writers do about it, because this is where the whole system starts eating itself. Writers who know they might be scanned have begun writing defensively: deleting em dashes, avoiding words that feel machine-flavored, roughing up their own sentences so the smoothness doesn’t incriminate them.
Think about that as a market signal. The scanner was supposed to protect good writing, and its first measurable effect is people making their writing worse on purpose to pass.
Meanwhile the evasion industry sells “humanizers” that launder model output in the other direction, the foundries poison the scrapers with muffins, and Pangram responds the only way it can, by mining ever-harder examples and retraining. Each round of this game burns a little more of the stylistic signal both sides depend on. An arms race where the battlefield is the evidence tends to end with no evidence.
Seven histories, one sentence
And beneath the whole spectacle sits a quieter problem, which is that the question being adjudicated stopped making sense a while ago.
Take one finished sentence and ask how it got there. A person wrote it alone. A person wrote it and Grammarly fixed it. A model drafted it and a person gutted and rebuilt it. A person’s ideas went through a model’s phrasing. A model’s ideas went through a person’s phrasing. It was translated. It was pasted.
Seven histories, one identical sentence, and a style meter cannot separate most of them, because the differences were never in the text. They were in time, in a chair, in a mind.
Pangram’s own researchers know this: their EditLens work grades AI involvement on an ordered scale rather than calling a binary coin flip, which is an admission, in model-card language, that “did AI write this” is not a yes/no question. The research says authorship is a spectrum of interventions. The scan button renders it as a percentage with the moral texture of a purity test.
That same iScience study caught what happens when yesterday’s forensics meet today’s hybrid text: a fake-news detector that scored 93 percent on human-written articles dropped to 75 percent on LLM-generated ones. The instruments are aging in real time, while the thing they measure dissolves as a category.
Nobody scans the scanner
One more detail, for connoisseurs of institutional confidence. As of the morning I am writing this, the main public API specification on Pangram’s developer docs, the machine-readable contract describing what the detector does, is a placeholder demo describing a plant store.
Mintlify’s sample file: a /plants endpoint, a sandbox server, the works. The prose docs are fine; the flagship spec file is botany.
The model is probably excellent. The paperwork is the tell: the verification business attracts almost no verification of its own. The company auditing the provenance of everyone else’s text is publishing someone else’s boilerplate as its own paperwork, and nobody noticed, because nobody scans the scanner.
Stop biting the coin
So: is writing with AI bad? I think we have been biting the wrong coin.
For most of monetary history, you authenticated a coin by inspecting it. Bite it, weigh it, squint at the edge. That worked while counterfeits were sloppy. The moment forgers minted from the same metal at the same weight, inspection died, and money moved its authenticity off the coin entirely: serial numbers, watermarks, ledgers. Provenance replaced vibes. Nobody bites coins anymore, not because counterfeiting stopped, but because the coin’s surface stopped carrying the answer.
Prose just became that coin. For all of literate history, fluent writing was a reliable receipt for something the reader actually wanted: evidence that a mind showed up, gathered facts, ordered them, made judgment calls. The receipt was hard to forge, so we treated the text and the thinking as the same object.
Then the forge opened, the receipt became free, and every institution that ran on it, schools, publications, Substack, panicked and reached for a better magnifying glass.
But the reader’s real question was never “did a machine touch this text.” It was “did a mind do this work, and is anyone honest with me about it.” Not-thinking is the harm. Undisclosed not-thinking is the fraud.
A person who thinks hard and uses a model to phrase it has not cheated you; a person who thought nothing and shipped the model’s thoughts under their name has. And a style percentage cannot tell those two apart, because thinking does not fluoresce under a stylometric lamp.
Which is why the most interesting thing Substack shipped in July is the boring little disclosure note beside the scanner, the first crude serial number in a provenance system that will eventually include draft histories, edit trails, and detectors honest enough to return “insufficient evidence” as a real answer.
If the gradient holds, and I am extrapolating now, so bite this claim as hard as you like, authorship will stop being a property adjudicated from text and become a property demonstrated from process. The document stops being the proof. The document becomes the receipt’s printout, and the receipt lives elsewhere.
My receipt
Which obliges me to print mine. This essay is a hybrid.
I chose this topic, read an 18-page Portuguese linguistics paper so you didn’t have to, ran the false-positive arithmetic, decided the muffins go first and the plant store goes late, and argued with claude about every claim you just read.
Scan it. The button is right there. You will get a number back: precise to two decimals, confident as a customs officer, and silent about every decision that made this piece worth your time or not. The number will tell you what this text resembles.
Whether anyone was thinking was always going to be your call.
Sources
ShieldFont press kit (Playtype and S&A) · Creative Bloq on ShieldFont · Dezeen on Decoy Font · Mixfont: Decoy Font · Engadget on the Substack launch · Substack help: detecting AI · Straight Arrow News on false-flag concerns · Pangram: how it works · Pangram technical report (arXiv) · EditLens (arXiv) · Rodrigues, Sturm and Pinheiro, iScience (2026) · The Washington Post’s Turnitin test · Yana G.Y.’s scan of her own AI-assisted post