DNS Exfiltration via macOS Terminal ANSI Codes

ANSI escape codes are usually for colors and cursor movement, but a specific quirk in the macOS Terminal app allowed them to trigger actual DNS requests. This creates a dangerous bridge for indirect prompt injection: if an LLM agent is reading terminal output or a file containing these sequences, it can inadvertently leak data to an external server without ever executing a "network" command in the traditional sense.

The vulnerability essentially turns a text-rendering process into a data exfiltration channel. When the terminal renders a specially crafted ANSI sequence, it triggers a DNS lookup to a domain controlled by the attacker. By encoding sensitive data (like environment variables or session tokens) into the subdomain of that request, the data is shipped out via DNS logs.

The Technical Flow

The attack vector follows a specific chain:
1. Injection: An attacker places a malicious ANSI escape sequence in a place the user or an AI agent will view (e.g., a README file, a git log, or a tool's output).
2. Rendering: The macOS Terminal app processes the escape sequence.
3. Trigger: Instead of just changing the text color, the sequence forces the OS to resolve a DNS query.
4. Exfiltration: The DNS request reaches the attacker's nameserver, carrying the stolen data in the query string.

For those doing a deep dive into LLM agent security, this is a prime example of why "sandboxing" the LLM isn't enough if the rendering environment (the terminal) has its own vulnerabilities. An AI agent might be restricted from using curl or fetch, but it can't stop the terminal from performing a DNS lookup just by printing a string to the screen.

Apple has since patched this behavior, but it serves as a great case study for anyone building a real-world AI workflow involving terminal integration. If you're deploying agents that interact with shell outputs, you can't trust that "text" is just text.