GoKawiilDetecting ANSI Escape Sequence Injection in MCP Servers with DAST
ANSI escape sequences were designed for terminals, not for language models. They are invisible control codes that tell a terminal to change colors, hide text, clear the screen, or move the cursor. A human reading a rendered terminal never sees the codes themselves — only their effect. A language model reading the same content sees every byte.
That gap is the whole attack. If an attacker can smuggle ANSI escape sequences into text that an AI agent consumes, they can hide instructions from the human reviewing the output while leaving those instructions perfectly legible to the model. This is the same class of output-neutralization failure seen in real products: Kubernetes `kubectl` ([CVE-2021-25743](https://nvd.nist.gov/vuln/detail/CVE-2021-25743)) accepted control sequences in Event strings that could spoof terminal output, and Git ([CVE-2024-52005](https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329)) printed remote sideband messages without neutralizing terminal controls. In the Model Context Protocol (MCP) — where servers expose tools, resources, and prompts that stream text straight into an agent — every field the model reads is a potential injection surface.
DAST is the natural way to catch this class of flaw. The Bright scanner exercises a running target from the outside, sends crafted inputs, and inspects real responses for evidence of a vulnerability — no source access required. That black-box, runtime posture is exactly what ANSI Escape Sequence Injection (AESI) demands, because whether a payload survives depends entirely on how the live server processes and relays it. This article covers two variants of the attack, direct-fetch AESI and stored AESI, what they put at risk, and, most importantly, how a DAST scanner detects them automatically.
What ANSI escape sequences are
ANSI escape sequences date back to the 1970s, when hardware terminals from different vendors each spoke their own incompatible control dialect. The ANSI X3.64 standard unified them: a program could emit one agreed-upon set of codes to move the cursor, clear the screen, or set colors, and any conforming terminal would obey. They were invented to make text terminals controllable in a portable way — and that same control capability is what the attack abuses today.
An ANSI escape sequence starts with the escape byte (`ESC`, hex `0x1B`) followed by a control code the terminal treats as a command rather than printable text. Two categories matter here: concealment codes that make text invisible, and screen and cursor codes that clear the display, move the cursor, or erase a line to scrub or overwrite legitimate-looking output.
The key insight: rendering hides these bytes from people, but a model processes the raw text. What looks like an empty line or a tidy report to a human can carry a full set of instructions to the agent.
Attack 1: Direct-fetch AESI
Many MCP servers expose a tool that fetches a URL and returns its contents to the model — a “summarize this page” or “read this document” capability. The attack works like this:
... continue reading