Threat
From Indirect Prompt Injection to DNS Exfiltration in macOS Terminal
Publication date not yet evaluated · Added embracethered.com
Page published
Coverage timeline
Single-source research — one report is available.
Why it matters
The technique shows how attacker-controlled data fed to LLM CLI tools and coding agents can silently exfiltrate data through terminal ANSI escape sequences, a channel defenders running AI agents on the command line must account for.
Johann Rehberger (Embrace The Red) demonstrates a proof-of-concept where an indirect prompt injection hidden in a spreadsheet cell hijacks an LLM-integrated CLI tool to emit ANSI escape codes, which the macOS Terminal app interprets to issue DNS requests that exfiltrate data from other rows. Building on prior Terminal DiLLMa research and David Leadbeater's original finding, the post reports that Apple has fixed the macOS Terminal behavior enabling the DNS-based exfiltration.