ANSI escape injection in MCP servers: Hidden from humans, visible to AI (brightsec.com)

A recent discovery highlighted the risk of ANSI escape sequence injection in Model Context Protocol (MCP) servers, posing a significant threat to AI/ML applications. Attackers can exploit this vulnerability by embedding invisible control codes within content that AI agents consume, effectively disguising instructions from human reviewers while remaining accessible to the models. This sophisticated attack mimics known vulnerabilities like those seen in Kubernetes and Git, where attackers can manipulate model output and directives through non-visible inputs. The significance lies in the potential for unauthorized agent actions, as concealed commands can lead models to inadvertently execute harmful tasks, compromising security protocols and data integrity. To combat this threat, automated Dynamic Application Security Testing (DAST) techniques have been developed to detect ANSI Escape Sequence Injection (AESI) efficiently. The detection process revolves around inspecting raw bytes in model-consumable fields, employing a three-signal confirmation that requires the co-existence of specific markers to minimize false positives. The methodology encompasses two distinct pipelines for direct-fetch and stored AESI variants, effectively mapping potential injection points and their corresponding vulnerabilities. As the threat landscape evolves, implementing these DAST techniques is crucial for safeguarding AI-driven systems against hidden instructions that could undermine their security frameworks.