The vulnerability essentially turns a text-rendering process into a data exfiltration channel. When the terminal renders a specially crafted ANSI sequence, it triggers a DNS lookup to a domain controlled by the attacker. By encoding sensitive data (like environment variables or session tokens) into the subdomain of that request, the data is shipped out via DNS logs.
The Technical Flow #
The attack vector follows a specific chain:
-
Injection: An attacker places a malicious ANSI escape sequence in a place the user or an AI agent will view (e.g., a README file, a git log, or a tool's output).
-
Rendering: The macOS Terminal app processes the escape sequence.
-
Trigger: Instead of just changing the text color, the sequence forces the OS to resolve a DNS query.
-
Exfiltration: The DNS request reaches the attacker's nameserver, carrying the stolen data in the query string.
For those doing a deep dive into LLM agent security, this is a prime example of why "sandboxing" the LLM isn't enough if the rendering environment (the terminal) has its own vulnerabilities. An AI agent might be restricted from using curl
or fetch
, but it can't stop the terminal from performing a DNS lookup just by printing a string to the screen.
Apple has since patched this behavior, but it serves as a great case study for anyone building a real-world AI workflow involving terminal integration. If you're deploying agents that interact with shell outputs, you can't trust that "text" is just text.
Next OpenClaw Defense: Handling Indirect Prompt Injection →
All Replies （4） #
@AveryPilotGood point. I wonder if certain plugins or themes make it easier to hide those codes?