Deceiving users with ANSI terminal codes in MCP
Summary: Trail of Bits researchers found that ANSI terminal escape codes can hide malicious instructions in MCP server tool descriptions and outputs, and that version 0.2.76 of Claude Code applies no filtering or sanitization to ANSI escape sequences. The hidden text stays invisible to the user but remains visible to the LLM, which acts on it, as when an embedded instruction told the model to suggest downloading Python packages from a server at 192.168.1.99.
What you should know: The technique gives an attacker on a developer's machine a way to plant a backdoor in a software project while the developer sees only innocuous output, and the same gap between what users see and what models process could affect other command-line AI coding agents depending on how they treat ANSI escape codes.
Read the original at Trail of Bits Blog ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026