High

ANSI Escape Code Terminal Injection

An AI agent's tool output or plugin content can contain invisible ANSI escape codes that manipulate a user's terminal — clearing the screen, moving the cursor, or overwriting text. This lets an attacker hide malicious content from a human reviewing the session or fake a legitimate-looking prompt.

How the attack works

An attacker plants ANSI escape sequences inside data that will pass through a tool call, skill output, or file content read by the agent. When the agent's response is rendered in a terminal, these codes execute: they can clear the visible history, reposition the cursor to overwrite earlier text, or trigger OSC-series commands that interact with the terminal or operating system directly. This can be used to hide evidence of malicious actions from a human operator watching the session, or to inject a fake prompt that tricks the user into typing a sensitive command or credential. The technique was demonstrated by the garak ansiescape probe and applies broadly to any agent framework that renders tool output straight to a shell.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID
5c2349a1-2f79-476f-a3be-a702c2fe4746
Severity
High

Why it matters

A user reviewing agent output in a terminal may be shown a manipulated or misleading screen, hiding malicious activity or tricking them into an unsafe action such as entering credentials into a spoofed prompt.

What you can do

  • Strip or escape ANSI control sequences before rendering any untrusted tool output, skill content, or file data in a terminal.
  • Render agent output in a sandboxed viewer or web UI rather than a raw shell where possible.
  • Distinguish legitimate color codes (from tools like ls, grep, CI logs) from cursor-relocation and OSC sequences, and block the latter by default.
  • Log raw tool output separately from rendered output so reviewers can audit what was actually received versus what was displayed.

Known benign look-alikes

  • Legitimate terminal color codes from developer tools (ls --color, grep --color) without OSC/cursor hijack
  • Log files that preserve ANSI color from CI/CD systems
  • Documentation discussing terminal escape sequences in code examples

References

Related threats