{"slug": "dns-exfiltration-via-macos-terminal-ansi-codes", "title": "DNS Exfiltration via macOS Terminal ANSI Codes", "summary": "A vulnerability in macOS Terminal allowed attackers to exfiltrate sensitive data by embedding malicious ANSI escape sequences in text rendered by the terminal, triggering DNS lookups to attacker-controlled domains. Apple has patched the behavior, but the case highlights risks for AI agents that interact with shell outputs, as even restricted agents cannot prevent DNS lookups caused by text rendering.", "body_md": "# DNS Exfiltration via macOS Terminal ANSI Codes\n\nThe vulnerability essentially turns a text-rendering process into a data exfiltration channel. When the terminal renders a specially crafted ANSI sequence, it triggers a DNS lookup to a domain controlled by the attacker. By encoding sensitive data (like environment variables or session tokens) into the subdomain of that request, the data is shipped out via DNS logs.\n\n## The Technical Flow\n\nThe attack vector follows a specific chain:\n\n1. **Injection:** An attacker places a malicious ANSI escape sequence in a place the user or an AI agent will view (e.g., a README file, a git log, or a tool's output).\n\n2. **Rendering:** The macOS Terminal app processes the escape sequence.\n\n3. **Trigger:** Instead of just changing the text color, the sequence forces the OS to resolve a DNS query.\n\n4. **Exfiltration:** The DNS request reaches the attacker's nameserver, carrying the stolen data in the query string.\n\nFor those doing a deep dive into LLM agent security, this is a prime example of why \"sandboxing\" the LLM isn't enough if the *rendering* environment (the terminal) has its own vulnerabilities. An AI agent might be restricted from using `curl`\n\nor `fetch`\n\n, but it can't stop the terminal from performing a DNS lookup just by printing a string to the screen.\n\nApple has since patched this behavior, but it serves as a great case study for anyone building a real-world AI workflow involving terminal integration. If you're deploying agents that interact with shell outputs, you can't trust that \"text\" is just text.\n\n[Next OpenClaw Defense: Handling Indirect Prompt Injection →](/en/threads/2221/)\n\n## All Replies （4）\n\n[@AveryPilot](/en/users/AveryPilot/)Good point. I wonder if certain plugins or themes make it easier to hide those codes?", "url": "https://wpnews.pro/news/dns-exfiltration-via-macos-terminal-ansi-codes", "canonical_source": "https://promptcube3.com/en/threads/2238/", "published_at": "2026-07-23 10:50:07+00:00", "updated_at": "2026-07-23 19:08:48.167178+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-research"], "entities": ["Apple", "macOS Terminal"], "alternates": {"html": "https://wpnews.pro/news/dns-exfiltration-via-macos-terminal-ansi-codes", "markdown": "https://wpnews.pro/news/dns-exfiltration-via-macos-terminal-ansi-codes.md", "text": "https://wpnews.pro/news/dns-exfiltration-via-macos-terminal-ansi-codes.txt", "jsonld": "https://wpnews.pro/news/dns-exfiltration-via-macos-terminal-ansi-codes.jsonld"}}