A security researcher demonstrates an end-to-end attack chain on macOS Terminal where indirect prompt injection in a CSV file causes an LLM-integrated CLI tool to emit ANSI escape codes that trigger DNS requests, exfiltrating data to an attacker-controlled server. The vulnerability was reported to Apple in December 2024 and fixed in macOS Tahoe 26.1. The post also provides guidance for CLI developers on safely encoding control characters using caret notation to prevent terminal hijacking via LLM output.
Table of contents
DNS Requests via ANSI Escape CodesRendering ANSI Escape Codes with AI Agents!Proof-of-Concept ExploitVideo WalkthroughDisclosureFor CLI Developers: Terminal-Friendly Encoding using Caret NotationConclusionReferences1.5K Impressions