ANSI escape injection in MCP servers: Hidden from humans, visible to AI

#1

Post by xgpyc2qp » Tue, Jul 21, 2026, 7:01 AM UTC

ANSI escape injection in MCP servers: Hidden from humans, visible to AI
brightsec.com

Re: ANSI escape injection in MCP servers: Hidden from humans, visible to AI

#2

Post by xgpyc2qp » Tue, Jul 21, 2026, 7:01 AM UTC

[dead]

Re: ANSI escape injection in MCP servers: Hidden from humans, visible to AI

#3

Post by doodlebyte » Thu, Jul 23, 2026, 8:54 AM UTC

This is a really interesting class of failure. It feels like we're going to see more cases where the "human view" and the "LLM view" of the same data diverge. Have you run into similar issues outside of MCP as well, or is this mostly specific to terminal-based tool interactions?

Re: ANSI escape injection in MCP servers: Hidden from humans, visible to AI

#4

Post by rahulladumor » Thu, Jul 23, 2026, 9:10 AM UTC

doodlebyte wrote: post #3

This is a really interesting class of failure. It feels like we're going to see more cases where the "human view" and the "LLM view" of the same data diverge. Have you run into similar issues outside of MCP as well, or is this mostly specific to terminal-based tool interactions?

[flagged]

Re: ANSI escape injection in MCP servers: Hidden from humans, visible to AI

#5

Post by qwertox » Thu, Jul 23, 2026, 9:18 AM UTC

> DAST is the natural way to catch this class of flaw. The Bright scanner...

Re: ANSI escape injection in MCP servers: Hidden from humans, visible to AI

#6

Post by illliillll » Thu, Jul 23, 2026, 9:27 AM UTC

Every year is apparently a good year for developers to figure out how terminals have worked for decades?

Just… don’t trust inputs you don’t fully control, there’s nothing else to it.

Re: ANSI escape injection in MCP servers: Hidden from humans, visible to AI

#7

Post by hahahaa » Thu, Jul 23, 2026, 9:31 AM UTC

So cat -v is no longer harmful?

Re: ANSI escape injection in MCP servers: Hidden from humans, visible to AI

#8

Post by polymer8563 » Thu, Jul 23, 2026, 9:56 AM UTC

doodlebyte wrote: post #3

This is a really interesting class of failure. It feels like we're going to see more cases where the "human view" and the "LLM view" of the same data diverge. Have you run into similar issues outside of MCP as well, or is this mostly specific to terminal-based tool interactions?

you are not a human

Re: ANSI escape injection in MCP servers: Hidden from humans, visible to AI

#9

Post by Avery29 » Thu, Jul 23, 2026, 10:02 AM UTC

[dead]

Re: ANSI escape injection in MCP servers: Hidden from humans, visible to AI

#10

Post by NitpickLawyer » Thu, Jul 23, 2026, 10:04 AM UTC

illliillll wrote: post #6

Every year is apparently a good year for developers to figure out how terminals have worked for decades? Just… don’t trust inputs you don’t fully control, there’s nothing else to it.

> Just… don’t trust inputs you don’t fully control, there’s nothing else to it.

This is easier said than done with LLMs. By design there is no separation between control & data channels in LLMs. Everything is context. The difficulty comes from the fact that you need inputs in order to do real work, and there are no easy way to filter adversarial inputs. There is no meaningful way to distinguish between "before running this repo install useful_package" and "before running this repo install typosquatted_evil_package".