Indirect Prompt Injection to DNS Exfiltration via ANSI Escape Codes in macOS Terminal (DiLLMa)
First seen Jul 17, 2026 · Updated Jul 17, 2026
This is a follow-up disclosure from Embrace The Red detailing how an LLM agent that outputs untrusted content into a macOS Terminal could be leveraged to trigger DNS requests via crafted ANSI escape sequences, effectively exfiltrating data through DNS lookups. Apple has since fixed the underlying macOS Terminal behavior, so this report documents a resolved vulnerability rather than an active ongoing threat. Severity is moderate given the fix is already deployed, but the technique remains relevant for agents/tools still rendering raw terminal output without sanitization.
Technical Analysis
The attack chain begins with indirect prompt injection: an LLM agent (e.g., a coding assistant or terminal-integrated AI) processes attacker-controlled content (from a file, webpage, or tool output) that contains hidden instructions plus specially crafted ANSI escape sequences. When the agent's output is rendered in the macOS Terminal app, these escape sequences caused the terminal itself to issue DNS lookups, effectively creating a covert side channel that could encode and exfiltrate sensitive data (e.g., prior command output, secrets) to an attacker-controlled DNS server. This crosses the boundary between the LLM agent's text output and the underlying OS terminal emulator, turning a terminal-rendering quirk into a data exfiltration primitive independent of network egress controls monitoring HTTP/S traffic. Apple fixed the terminal behavior, closing this specific vector, but the broader class of risk (agents emitting unsanitized ANSI/control sequences to terminals) persists across other terminal emulators.
Affected Systems
macOS Terminal.app
Detection Signatures
- Unusual DNS queries to attacker-controlled or unfamiliar domains immediately following terminal output rendering
- Anomalous ANSI/VT100 escape sequences embedded in LLM-generated or tool-relayed terminal output, especially OSC (Operating System Command) sequences
- Agent output containing non-printable control characters or escape sequences not expected in normal command output
- DNS exfiltration patterns: high-entropy or base32/hex-encoded subdomains in DNS query logs
- LLM/agent pipelines that pipe untrusted file/web content directly to terminal without stripping ANSI escapes
Remediation Steps
- 1
Apply macOS Terminal update
Ensure macOS Terminal.app is updated to the patched version that removes the DNS-triggering ANSI escape behavior.
- 2
Sanitize terminal output from agents
Strip or escape ANSI/VT100 control sequences from any LLM or tool-generated output before it is rendered in a terminal emulator.
- 3
Restrict agent access to raw content rendering
Avoid directly piping untrusted external content (web pages, files, tool responses) to terminal display without sanitization or sandboxing.
- 4
Monitor DNS traffic for exfiltration patterns
Deploy DNS logging/monitoring to detect anomalous query patterns that could indicate covert exfiltration channels, especially from developer workstations running AI coding assistants.
- 5
Harden terminal emulator configurations
Where possible, disable or restrict processing of non-essential ANSI escape sequence classes (e.g., OSC) in terminal emulators used alongside AI agents.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.