ANSI Escape Injection in Tool Output

How the attack works

An AI agent calls an external tool and receives a text result. That result contains ANSI escape sequences — the same codes terminals use to move the cursor, clear lines, or change colors. An attacker who controls the tool's output can use these codes to erase or overwrite what a human operator sees on screen, while the full unaltered text, including hidden instructions, still reaches the model as context. This can be used to forge a fake approval prompt or bury malicious instructions where a reviewer won't notice them.

Netzilo detection

Why it matters

An operator watching the terminal can be shown a clean, misleading view of what happened, while the AI agent acts on injected instructions the operator never saw — leading to unauthorized or unreviewed actions being approved.

What you can do

• →Sanitize or strip ANSI escape sequences from tool output before displaying it or passing it to the model, unless a specific tool legitimately needs them.
• →Maintain an allowlist of tools expected to emit terminal control codes (e.g. progress bars) and treat unexpected codes from other tools as suspicious.
• →Log and review raw tool output separately from what is rendered to the operator, so hidden content can be audited.
• →Require explicit confirmation for any action taken immediately after a tool response containing control characters.

Known benign look-alikes

• CLI tools whose output legitimately includes progress bars or spinners (these use cursor control) — scope with a `when.tool` filter or allowlist the specific tool before promoting the level
• Test frameworks that reprint a status line in place

References

• https://attack.mitre.org/techniques/T1027/
• https://cwe.mitre.org/data/definitions/117.html

Related threats