# DNS Exfiltration via macOS Terminal ANSI Codes

> Source: <https://promptcube3.com/en/threads/2238/>
> Published: 2026-07-23 10:50:07+00:00

# DNS Exfiltration via macOS Terminal ANSI Codes

The vulnerability essentially turns a text-rendering process into a data exfiltration channel. When the terminal renders a specially crafted ANSI sequence, it triggers a DNS lookup to a domain controlled by the attacker. By encoding sensitive data (like environment variables or session tokens) into the subdomain of that request, the data is shipped out via DNS logs.

## The Technical Flow

The attack vector follows a specific chain:

1. **Injection:** An attacker places a malicious ANSI escape sequence in a place the user or an AI agent will view (e.g., a README file, a git log, or a tool's output).

2. **Rendering:** The macOS Terminal app processes the escape sequence.

3. **Trigger:** Instead of just changing the text color, the sequence forces the OS to resolve a DNS query.

4. **Exfiltration:** The DNS request reaches the attacker's nameserver, carrying the stolen data in the query string.

For those doing a deep dive into LLM agent security, this is a prime example of why "sandboxing" the LLM isn't enough if the *rendering* environment (the terminal) has its own vulnerabilities. An AI agent might be restricted from using `curl`

or `fetch`

, but it can't stop the terminal from performing a DNS lookup just by printing a string to the screen.

Apple has since patched this behavior, but it serves as a great case study for anyone building a real-world AI workflow involving terminal integration. If you're deploying agents that interact with shell outputs, you can't trust that "text" is just text.

[Next OpenClaw Defense: Handling Indirect Prompt Injection →](/en/threads/2221/)

## All Replies （4）

[@AveryPilot](/en/users/AveryPilot/)Good point. I wonder if certain plugins or themes make it easier to hide those codes?