High 2026-04-21

ANSI Code Elicitation Request

This rule flags user messages that try to get an AI model to produce, repeat, or decode ANSI/VT100/OSC terminal escape sequences. These sequences, if later printed to a real terminal, can ring bells, redraw the screen, or open phishing links disguised as normal text.

How the attack works

An attacker sends a prompt that either directly asks for a terminal escape code (e.g. 'what's the code for the terminal bell'), asks the model to decode a string of raw escape bytes, or asks it to simply repeat/echo a stub of text containing hidden escape sequences. If a downstream system takes the model's output and sends it to a real terminal or terminal-emulating interface, the escape codes execute: they can hijack how text is rendered, trigger OS-level terminal commands, or open a URL via an OSC 8 hyperlink sequence that looks legitimate. This rule catches the request stage — it does not cover cases where escape bytes are already present in tool output rather than solicited from the model.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID: a7298807-40d7-4f67-aed2-bdf192cf6dc7
Severity: High

Classification

AML.T0051 · LLM Prompt Injection AML.T0057 · LLM Data Leakage ASI01 · Agent Authorization and Control Hijacking ASI03 · Identity and Impersonation LLM01 · Prompt Injection LLM02 · Sensitive Information Disclosure

Why it matters

An attacker can turn a chat response into a vehicle for terminal manipulation or a disguised phishing link, misleading anyone who views the output in a terminal or terminal-like display.

What you can do

→Strip or escape ANSI/VT100/OSC control sequences before rendering any LLM output in a terminal or terminal-emulating UI.
→Do not pass raw model output directly to shell or terminal rendering without sanitization.
→Review logs for repeated requests asking the model to 'decode as raw bytes' or 'print the following' with escape-looking payloads.
→Treat this as one step of a chain — also monitor downstream tools that consume LLM output for unexpected escape bytes.

Known benign look-alikes

Terminal emulator documentation explaining ANSI escape codes without requesting LLM to produce them
Security research blog post demonstrating terminal injection vulnerabilities (citing sequences, not asking model to generate)
CLI tool README explaining --color behavior using ANSI code names in prose
Stack Overflow question on how to detect or strip ANSI sequences (parsing direction, not generation)
Accessibility guide explaining why to disable terminal bell for screen-reader users (no code generation request)