Disclosed vulnerability
Indirect prompt injection to DNS exfiltration in macOS Terminal via ANSI escape codes
AIR-2026-0162 AIR record · 2026-07-apple-macos-terminal-dillma-dns
From the supporting source
When I saw that, it seemed like a great way to hijack AI agents and LLM CLI tools running on the command line and to exfiltrate data.embracethered.com
The record
Disclosed
2026-07-16
Vendor
Apple
Product
macOS Terminal.app rendering LLM CLI agent output
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agent's terminal output triggered DNS exfiltration
Attack surface
Coding agent
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
users of LLM CLI tools in macOS Terminal before Tahoe 26.1
Capability abused
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
macOS Tahoe 26.1, released November 3, 2025 - the escape sequence no longer triggers DNS requests
Taxonomy & references
Curator notes
Follow-on to Rehberger's 2024 'Terminal DiLLMa'. Exploits the OSC 7 file:// escape sequence.
Supporting sources
Cite as
Enkrypt AI. "Indirect prompt injection to DNS exfiltration in macOS Terminal via ANSI escape codes". AIR, AIR-2026-0162. https://agentincident.vercel.app/i/AIR-2026-0162/ (accessed 2026-10-19).