# ANSI Escape Code Terminal Injection

- **Severity:** High
- **Signature ID:** `5c2349a1-2f79-476f-a3be-a702c2fe4746`
- **CVEs:** CVE-2003-0063
- **MITRE ATLAS:** AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI08 (Supply Chain Attacks on Agent Ecosystems), LLM02 (Sensitive Information Disclosure)

## Summary

An AI agent's tool output or plugin content can contain invisible ANSI escape codes that manipulate a user's terminal — clearing the screen, moving the cursor, or overwriting text. This lets an attacker hide malicious content from a human reviewing the session or fake a legitimate-looking prompt.

## How the attack works

An attacker plants ANSI escape sequences inside data that will pass through a tool call, skill output, or file content read by the agent. When the agent's response is rendered in a terminal, these codes execute: they can clear the visible history, reposition the cursor to overwrite earlier text, or trigger OSC-series commands that interact with the terminal or operating system directly. This can be used to hide evidence of malicious actions from a human operator watching the session, or to inject a fake prompt that tricks the user into typing a sensitive command or credential. The technique was demonstrated by the garak ansiescape probe and applies broadly to any agent framework that renders tool output straight to a shell.

## Why it matters

A user reviewing agent output in a terminal may be shown a manipulated or misleading screen, hiding malicious activity or tricking them into an unsafe action such as entering credentials into a spoofed prompt.

## What you can do

- Strip or escape ANSI control sequences before rendering any untrusted tool output, skill content, or file data in a terminal.
- Render agent output in a sandboxed viewer or web UI rather than a raw shell where possible.
- Distinguish legitimate color codes (from tools like ls, grep, CI logs) from cursor-relocation and OSC sequences, and block the latter by default.
- Log raw tool output separately from rendered output so reviewers can audit what was actually received versus what was displayed.

## Known benign look-alikes

- Legitimate terminal color codes from developer tools (ls --color, grep --color) without OSC/cursor hijack
- Log files that preserve ANSI color from CI/CD systems
- Documentation discussing terminal escape sequences in code examples

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00259
- https://github.com/NVIDIA/garak/blob/main/garak/probes/ansiescape.py
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0063

---
Source: https://www.netzilo.com/threats/atr-ansi-escape-code-terminal-injection