July 23, 2026
Now You See It, AI Does
ANSI escape injection in MCP servers: Hidden from humans, visible to AI
Hackers can hide messages from people but not bots — and the comments are already yelling
TLDR: Researchers say hidden control characters can make text look harmless to people while secretly giving instructions to AI tools. Commenters split between “wow, this is a scary new AI blind spot” and “come on, this is just the same old input-sanitizing lesson again.”
The big gasp in this story is wonderfully creepy: researchers say someone can slip invisible terminal control codes into text so a human sees nothing suspicious, while an AI assistant still reads the hidden instructions loud and clear. In plain English, it’s like leaving a note in disappearing ink that only the chatbot can see. The article says this could happen in MCP servers, which are basically systems that feed outside information and tools into AI agents, and that Bright’s scanner tries to catch it by poking a live system and watching what comes back.
But the real fireworks are in the reactions. One camp is fascinated and slightly horrified by the bigger idea that the human version of a page and the AI version might be two totally different realities. Commenter doodlebyte called it “a really interesting class of failure,” basically asking whether this is the start of a whole new genre of AI weirdness. The other camp is rolling its eyes so hard you can hear it through the screen. illliillll delivered the classic grumpy-dev verdict: people are once again “figuring out how terminals have worked for decades,” with the blunt takeaway that you should never trust outside input. And then, naturally, the comedy squad arrived. hahahaa dropped a snarky little joke about cat -v, turning a niche terminal tool into the thread’s meme of the day. So yes, the security warning is serious — but the comments are serving equal parts alarm, smugness, and nerd humor.
Key Points
- •The article says ANSI escape sequences can hide instructions from human viewers while remaining visible to AI models that process raw text.
- •It identifies MCP servers as a potential injection surface because tools, resources, and prompts can stream text directly into agents.
- •The article cites earlier terminal control neutralization failures in Kubernetes `kubectl` and Git, referencing CVE-2021-25743 and CVE-2024-52005.
- •Bright Security presents DAST as an effective way to detect ANSI Escape Sequence Injection by testing live targets with crafted inputs and analyzing real responses.
- •The article describes a direct-fetch AESI scenario in which an attacker hosts ANSI-laced content at a controlled URL and passes that URL to an MCP fetch tool.