# Terminal DiLLMa: LLM-powered Apps Can Hijack Your Terminal Via Prompt Injection

LLM CLI apps printing raw model output let prompt-injected ANSI escape codes hijack terminals, leaking prompt data via hyperlinks/DNS and enabling clipboard code execution.

- Payout: Research
- Severity: medium
- Program: LLM CLI apps
- Write-up by: Johann Rehberger
- Disclosed: 2024-12-06
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2024/terminal-dillmas-prompt-injection-ansi-sequences/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-terminal-dillmas-prompt-injection-ansi-sequences
- Tags: area:ai domain:ai impact:data-leak impact:rce kind:research platform:research sev:medium tech:llm technique:chained vuln:command-injection vuln:info-disclosure vuln:prompt-injection

**Target:** LLM-integrated CLI tools printing model output to terminal
**Root cause:** LLM output is untrusted but printed to stdout without encoding ANSI control characters, so terminal emulators interpret injected escape sequences.
**Steps:**
1. Build/use dillma.py: sends system prompt + attached file to GPT-4o, prints response to terminal
2. Embed prompt injection in analyzed file/webpage instructing model to emit ESC (0x1b) sequences
3. Model reflects control chars; terminal interprets them (color, cursor move, clear, beep)
4. For data leak: inject OSC 8 hyperlink containing prompt-context data; VS Code terminal renders clickable link
5. For clipboard/code exec: inject OSC 52 clipboard write; some terminals keep trailing newline enabling execution
6. For macOS DNS leak: inject escape sequence triggering DNS request encoding prompt data
7. Mitigate with -v caret-notation encoding of control chars
**How found:** Built on Leon Derczynski's finding that LLMs emit ESC characters; reused prior ANSI payload notes from STÖK/David Leadbeater talks, converted them into prompt injection test cases, and discovered LLMs can also read/reflect control characters for reliability.
**Exploitation:** Attacker controls a file or webpage the victim asks the LLM CLI tool to summarize; injected instructions make the model emit ANSI/OSC sequences that the terminal executes, leaking context via hyperlinks or DNS, or writing to clipboard.
**Escalation:** Chained prompt injection with terminal escape features (OSC 8 links, OSC 52 clipboard, macOS DNS) to move from output manipulation to data exfiltration and potential code execution.
**Insight:** When auditing LLM CLI/agent tools, test whether model output reaches a terminal unencoded; OSC 8 hyperlinks and OSC 52 clipboard writes are high-value primitives for leaking prompt context or achieving code exec, and code-interpreter tool invocation makes emitting arbitrary control bytes far more reliable than native prompting.