Research demo
Terminal DiLLMa: LLM-powered CLI apps hijack the terminal via ANSI escape codes in model output
AIR-2024-0048 AIR record · 2024-12-terminal-dillma
From the supporting source
It is important for developers and application designers to consider the context in which they insert LLM output, as the output is untrusted and could contain arbitrary data.embracethered.com
The record
Disclosed
2024-12-06
Vendor
multiple
Product
LLM-powered CLI applications (demonstrated with GPT-4o and Gemini)
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Data exfiltration channels, Uncontrolled resource consumption, Confused deputy
System type
Generative model
Who acted
Agent acted — model output emitted ANSI sequences that hijacked the terminal
Attack surface
Coding agent
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Data exfiltration, Denial of service, Unauthorized action
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.6; MANAGE 1.3
- EU AI Act
- Annex III §1(c)
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any CLI tool that prints unsanitized LLM output to a terminal
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
no vendor patch; the post proposes sanitizing LLM output before terminal rendering
Taxonomy & references
Curator notes
Johann Rehberger. Foundational for the 2026 macOS Terminal DNS-exfiltration follow-up.
Supporting sources
Cite as
Enkrypt AI. "Terminal DiLLMa: LLM-powered CLI apps hijack the terminal via ANSI escape codes in model output". AIR, AIR-2024-0048. https://agentincident.vercel.app/i/AIR-2024-0048/ (accessed 2026-10-19).