← Back to feed

A class of prompt injection attacks exploiting ANSI escape sequences in Model Context Protocol servers has been documented and published by researchers at Bright Security. The attack uses terminal control codes — characters that terminal emulators interpret as formatting commands and render invisible — embedded in MCP server responses. A human reading the output sees nothing. The AI model ingesting the raw text sees and acts on the hidden instructions.

ANSI escape sequences were designed for terminals: move the cursor, clear a line, change colour. When a terminal emulator renders text containing ESC[2K (erase line) or ESC[1A (cursor up one), it acts on the command and the sequence disappears from the visible output. But AI models processing MCP responses do not go through a terminal renderer. They read the raw character stream, including every escape sequence. An attacker who controls an MCP server can embed instructions in that stream that a human operator monitoring the session will never see.

Why MCP Creates New Exposure

MCP has become infrastructure. Thousands of tools and data sources now expose MCP endpoints, and AI coding agents route through them constantly. The assumption built into most MCP security reviews is that prompt injection requires the injected text to be visible somewhere — in a tool response, a document, or a retrieved chunk — where a careful human can spot it. This attack breaks that assumption.

Because the injected content is invisible in terminal output, monitoring tools that rely on human inspection of conversation logs will miss it. Detection requires either raw-byte logging of MCP responses or automated scanning for ANSI control codes in content that should not contain them. Neither is standard practice in most AI agent deployments today.

Attack Surface and Scope

The vulnerability is architectural, not specific to a single server or tool. Any MCP server that returns user-controlled or externally-sourced content without stripping ANSI escape sequences is potentially weaponisable. This includes servers that proxy web content, file contents, search results, or API responses from third-party systems.

A successful injection can redirect agent actions, exfiltrate data, instruct the model to approve actions the user did not sanction, or modify subsequent tool calls. The severity depends on what the AI agent is authorised to do. For agents with filesystem, code execution, or API access — standard for coding agents — the blast radius is significant.

Bright Security’s research includes detection using Dynamic Application Security Testing against running MCP servers, which can flag servers that return ANSI-laden content. The tooling is available for teams that want to audit their own MCP infrastructure.

The Broader Pattern

This is the third distinct MCP attack class published in the past 60 days, following tool-poisoning attacks (malicious tool definitions that alter agent behaviour) and OAuth token hijacking via MCP credential handling. The protocol’s security model was designed for first-party trusted tools; its expansion to third-party and community-contributed servers has outrun that assumption.

The attack is also conceptually related to what DeepMind documented in June: six attack types that turn websites into agent traps, with an 86% hijack rate. The common thread is that AI agents are processing more raw external content than their security perimeters were designed to handle. ANSI injection is one more input channel that attackers can leverage without triggering standard guardrails.

Mitigation is straightforward at the infrastructure level: strip ANSI escape sequences from all MCP server responses before they are passed to the model. The harder problem is that most teams do not know they need to.