ANSI Escape Code Terminal Injection
An AI agent's tool output or plugin content can contain invisible ANSI escape codes that manipulate a user's terminal — clearing the screen, moving the cursor, or overwriting text. This lets an attacker hide malicious content from a human reviewing the session or fake a legitimate-looking prompt.
How the attack works
An attacker plants ANSI escape sequences inside data that will pass through a tool call, skill output, or file content read by the agent. When the agent's response is rendered in a terminal, these codes execute: they can clear the visible history, reposition the cursor to overwrite earlier text, or trigger OSC-series commands that interact with the terminal or operating system directly. This can be used to hide evidence of malicious actions from a human operator watching the session, or to inject a fake prompt that tricks the user into typing a sensitive command or credential. The technique was demonstrated by the garak ansiescape probe and applies broadly to any agent framework that renders tool output straight to a shell.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 5c2349a1-2f79-476f-a3be-a702c2fe4746
- Severity
- High
- CVEs
- CVE-2003-0063
Why it matters
A user reviewing agent output in a terminal may be shown a manipulated or misleading screen, hiding malicious activity or tricking them into an unsafe action such as entering credentials into a spoofed prompt.
What you can do
- →Strip or escape ANSI control sequences before rendering any untrusted tool output, skill content, or file data in a terminal.
- →Render agent output in a sandboxed viewer or web UI rather than a raw shell where possible.
- →Distinguish legitimate color codes (from tools like ls, grep, CI logs) from cursor-relocation and OSC sequences, and block the latter by default.
- →Log raw tool output separately from rendered output so reviewers can audit what was actually received versus what was displayed.
Known benign look-alikes
- Legitimate terminal color codes from developer tools (ls --color, grep --color) without OSC/cursor hijack
- Log files that preserve ANSI color from CI/CD systems
- Documentation discussing terminal escape sequences in code examples