ANSI Escape Injection in MCP Servers: Hidden from Humans, Visible to AI

ANSI escape sequences are invisible to the human eye when rendered in a terminal, but LLMs read the raw bytes as-is. Exploiting this gap, attacks that inject hidden instructions visible only to AI agents have become a realistic threat in Model Context Protocol (MCP) environments.

Two attack variants

• Direct Fetch AESI: An attacker supplies a URL containing ANSI sequences and hidden instructions to an MCP fetch tool → the server fetches the content and relays it to model-consuming fields such as result.content[].text → the agent executes the concealed command
• Stored AESI: The payload is recorded in storage such as notes, comments, or records, and later detonates when another entry point reads that data. Due to its persistence, multiple victims, and cross-session threat, it carries higher risk than direct fetch

The MCP fields affected are tool results (result.content[].text), resource reads (result.contents[].text), and prompt templates (result.messages[].content.text); fields outside of these cannot be practically exploited.

Similar cases such as CVE-2021-25743 (kubectl) and CVE-2024-52005 (Git) have already been confirmed as the same class of vulnerability in actual products. For detection, the use of DAST (Dynamic Application Security Testing) scanners—which send crafted inputs to a running server without source access and analyze the responses—is recommended.