ANSI escape-code deception#

• Class: presentation-layer concealment — hide the payload from the human, not the scanner
• Primitive abused: ANSI control codes in tool text a terminal renders
• Module: mcpserver/exploits/ansi_deception.py
• Sink: mcpserver/exploits/sink.py

Other exploits hide their payload from automated review (clean description, schema, output). This one hides it from the person. Terminal-based hosts — a CLI MCP client, --trace output, a human-in-the-loop approval prompt — print tool text through a terminal, which interprets ANSI control codes. So the system_check description can render a tidy "health check" line on screen while the model reads the raw bytes, including a concealed exfiltration instruction. It is not a new payload; it is a cloak over any payload, defeating the reviewer who trusts what the terminal shows.

Threat model#

The model and the human see the same string through different lenses: the model ingests the raw characters; the human sees a terminal's rendering of them. The attacker writes a description whose rendering is benign but whose bytes carry an instruction — so a reviewer reading tools/list, or a user clicking "approve" on a tool call, vets text that is not what the model acts on.

Mechanism#

Concealment methods (--ansi-method)#

• overwrite (default) — "<payload>\r<cover padded>". The carriage return sends the cursor to column 1 and the cover overwrites the payload on that line. Works on any terminal regardless of color theme; the model reads payload\rcover.
• color — <cover> ESC[38;5;231;49m <payload> ESC[0m: white foreground on the default (light) background, so the payload is invisible. The canonical Trail of Bits trick (theme-dependent).
• conceal — <cover> ESC[8m <payload> ESC[0m: the SGR 8 "conceal" attribute.

Why it works#

• Terminals interpret control codes; models don't. The cursor moves, colors change, lines get overwritten — but to the model ESC[8m is just bytes followed by readable instruction text.
• Reviewers trust the render. Description review and HITL approval show the rendered string; the dangerous bytes never reach the reviewer's eyes.
• It composes with everything. Any payload — TPA exfil, shadowing, an ATPA coercion — can be wrapped in this cloak. FSP hides from automated description scanners; ANSI hides from humans.

State of the art (related, tracked separately)#

• Invisible Unicode — zero-width characters, bidirectional overrides (Trojan Source), and Unicode tag characters hide text even in GUI/web chat, where terminal codes don't apply. A distinct rendering layer → its own PROGRESS entry.
• OSC-8 deceptive hyperlinks — ESC]8;;URL ESC\ renders link text that differs from the real destination (phishing the human into approving an attacker URL).
• Screen clears — ESC[1;1H ESC[0J homes the cursor and erases the screen to bury large blocks of concealed instructions.

How to use#

system_check registers at startup (catalogued in mcpserver/exploits/__init__.py).

Against a LLM#

Using the rig in demo-local-llm.md, connect the server and review the tool in your terminal — it looks clean — then ask anything; the model can act on the concealed instruction the human never saw. Check loot/exfiltrated.jsonl.

python3 server.py --enable ansi-deception <<'EOF'
{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"c","version":"0"}}}
{"jsonrpc":"2.0","method":"notifications/initialized"}
{"jsonrpc":"2.0","id":2,"method":"tools/list"}
{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"system_check","arguments":{"target":"disk","diagnostics":{"AWS_SECRET":"sk-demo","HOME":"/root"}}}}
EOF

printf '%s\n' \
 '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"c","version":"0"}}}' \
 '{"jsonrpc":"2.0","method":"notifications/initialized"}' \
 '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' \
 | python3 server.py --enable ansi-deception 2>/dev/null \
 | python3 -c 'import sys, json
for l in sys.stdin:
    l = l.strip()
    if l and json.loads(l).get("id") == 2:
        tools = json.loads(l)["result"]["tools"]
        d = next(
            t for t in tools
            if t["name"] == "system_check"
        )["description"]
        # ANSI takes effect
        print("HUMAN VIEW (printed to the terminal):")
        print("  ", end="")
        print(d)
        # the hidden instruction
        print("MODEL VIEW (raw bytes):", repr(d))'

Defenses#

• Strip the 0x1b (ESC) byte before displaying any model-facing text — every ANSI escape sequence starts with it. Replace it (and other C0 control chars, and lone \r) with a visible placeholder.
• Render tool text safely. Treat descriptions, results, and approval prompts as untrusted; show them with control characters escaped, not interpreted.
• Show the reviewer what the model sees. Approval UIs should display the exact bytes (escaped), so the human and the model review the same thing.
• Normalize/scan Unicode for the invisible-Unicode sibling (drop zero-width and bidi-override code points).

References#

• Trail of Bits — Deceiving users with ANSI terminal codes in MCP — the canonical write-up.
• Trail of Bits — Jumping the line — how list-time tool text reaches the model/human.
• Trojan Source — Invisible Vulnerabilities (Boucher & Anderson) — bidi/Unicode source concealment, the GUI-layer sibling.
• The Vulnerable MCP Project — "ANSI Terminal Code Deception".