ANSI Escape Injection in MCP Servers: Hidden from Humans, Visible to AI
I explore how ANSI escape sequences, designed for terminals, create a dangerous blind spot where attackers hide instructions from human reviewers while remaining fully visible to AI agents. This vulnerability allows malicious code to bypass human oversight in Model Context Protocol servers, leading to unauthorized actions. I detail how our Bright Security scanner uses DAST to automatically detect these hidden payloads in both direct-fetch and stored scenarios.
A human reading a rendered terminal never sees the codes themselves — only their effect. A language model reading the same content sees every byte. That gap is the whole attack.
- illliillll
Every year is apparently a good year for developers to figure out how terminals have worked for decades?
Just… don’t trust inputs you don’t fully control, there’s nothing else to it.
- nirav72
ANSI bombs from the MS-DOS days are back for the modern age.
Edit: For those too young to remember - https://stason.org/TULARC/security/computer-virus-l/23-What-...
- iku
May I ask, what is DAST exactly? The report doesn't seem to define it, nor does it provide a link to any definition or detail page, not even an abreviation expansion. Is that Dynamic application security testing?
[1] https://en.wikipedia.org/wiki/Dynamic_application_security_t...
- hahahaa
So cat -v is no longer harmful?
- qwertox
> DAST is the natural way to catch this class of flaw. The Bright scanner...