Threat · curated 17 Jul 2026
From Indirect Prompt Injection to DNS Exfiltration in macOS Terminal
First reported embracethered.com
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
The technique shows how attacker-controlled data fed to LLM CLI tools and coding agents can silently exfiltrate data through terminal ANSI escape sequences, a channel defenders running AI agents on the command line must account for.
Johann Rehberger (Embrace The Red) demonstrates a proof-of-concept where an indirect prompt injection hidden in a spreadsheet cell hijacks an LLM-integrated CLI tool to emit ANSI escape codes, which the macOS Terminal app interprets to issue DNS requests that exfiltrate data from other rows. Building on prior Terminal DiLLMa research and David Leadbeater's original finding, the post reports that Apple has fixed the macOS Terminal behavior enabling the DNS-based exfiltration.