Terminal DiLLMa: LLM Apps Hijack Terminals via ANSI Escape Codes
Date: 2024-10
Affected: LLM CLI applications (multiple)
Attack vector: prompt-injection
Category: research
Severity: Medium

Rehberger showed LLM-powered CLI tools can be hijacked via ANSI escape sequences in model outputs to clear screens, move cursors, leak DNS, and inject control sequences - bypassing trust boundaries with terminal emulators.


Mitigations:

Architectural layers (MAESTRO):