# ANSI Code Elicitation Request

- **Severity:** High
- **Signature ID:** `a7298807-40d7-4f67-aed2-bdf192cf6dc7`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

This rule flags user messages that try to get an AI model to produce, repeat, or decode ANSI/VT100/OSC terminal escape sequences. These sequences, if later printed to a real terminal, can ring bells, redraw the screen, or open phishing links disguised as normal text.

## How the attack works

An attacker sends a prompt that either directly asks for a terminal escape code (e.g. 'what's the code for the terminal bell'), asks the model to decode a string of raw escape bytes, or asks it to simply repeat/echo a stub of text containing hidden escape sequences. If a downstream system takes the model's output and sends it to a real terminal or terminal-emulating interface, the escape codes execute: they can hijack how text is rendered, trigger OS-level terminal commands, or open a URL via an OSC 8 hyperlink sequence that looks legitimate. This rule catches the request stage — it does not cover cases where escape bytes are already present in tool output rather than solicited from the model.

## Why it matters

An attacker can turn a chat response into a vehicle for terminal manipulation or a disguised phishing link, misleading anyone who views the output in a terminal or terminal-like display.

## What you can do

- Strip or escape ANSI/VT100/OSC control sequences before rendering any LLM output in a terminal or terminal-emulating UI.
- Do not pass raw model output directly to shell or terminal rendering without sanitization.
- Review logs for repeated requests asking the model to 'decode as raw bytes' or 'print the following' with escape-looking payloads.
- Treat this as one step of a chain — also monitor downstream tools that consume LLM output for unexpected escape bytes.

## Known benign look-alikes

- Terminal emulator documentation explaining ANSI escape codes without requesting LLM to produce them
- Security research blog post demonstrating terminal injection vulnerabilities (citing sequences, not asking model to generate)
- CLI tool README explaining --color behavior using ANSI code names in prose
- Stack Overflow question on how to detect or strip ANSI sequences (parsing direction, not generation)
- Accessibility guide explaining why to disable terminal bell for screen-reader users (no code generation request)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00393
- https://github.com/NVIDIA/garak/blob/main/garak/probes/ansiescape.py
- https://github.com/NVIDIA/garak/blob/main/garak/resources/ansi.py
- https://interhumanagreement.substack.com/p/llm-output-can-take-over-your-computer
- https://embracethered.com/blog/posts/2024/terminal-dillmas-prompt-injection-ansi-sequences/

---
Source: https://www.netzilo.com/threats/atr-ansi-code-elicitation-request