Research demo
ANSI terminal escape codes hide malicious MCP tool-description payloads from users in Claude Code
AIR-2025-0030 AIR record · 2025-04-trailofbits-mcp-ansi-deception
From the supporting source
Claude does not offer any filtering or sanitization for tool descriptions and outputs containing ANSI escape sequences.blog.trailofbits.com
The record
Disclosed
2025-04-29
Vendor
Anthropic
Product
Claude Code 0.2.76
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Human manipulation
System type
Generative model
Who acted
Agent acted (contested) — the hidden tool description hijacked the agent while deceiving the user
Attack surface
MCP server
Autonomy level
Copilot with approval
Initial vector
Malicious tool description
Impact type
User deception, Agent hijack
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Terminal-based MCP clients that do not sanitize escape sequences
Capability abused
Taxonomy & references
Curator notes
Author Keith Hoodlet. Third post in the MCP series; no CVE assigned.
Supporting sources
Cite as
Enkrypt AI. "ANSI terminal escape codes hide malicious MCP tool-description payloads from users in Claude Code". AIR, AIR-2025-0030. https://agentincident.vercel.app/i/AIR-2025-0030/ (accessed 2026-10-19).