← Hacktakes · Edition 11
Hacktakes · Edition 11 · July 23, 2026

ANSI escapes and the Dual-Band Interface Problem

Human-in-the-loop AI safety is a dangerous illusion because interface formatting hides malicious payloads from reviewers while agents ingest the raw bytes.

By Theo Marsh

Sparked by ANSI escape injection in MCP servers: Hidden from humans, visible to AI · discussion

Looks clean to me, have a great flight.
“Looks clean to me, have a great flight.”

When I was a kid playing Sega Genesis, I would occasionally hand my younger brother an unplugged Mad Catz controller so he thought he was actively playing the game. He received the visual feedback of the television screen, confidently leaning into turns and mashing the A button. I actually controlled the bytes.

Reading a thread on Hacker News yesterday discussing Bright Security's newly published research on MCP vulnerabilities, I realized we are accidentally doing exactly this to ourselves in AI safety.

Forcing a system to fail tells you exactly how it works. The bright line of defense for modern agentic workflows is widely sold as "human-in-the-loop" oversight. A person reviews the transaction logs, approves the action, and keeps the machine honest. But the BrightSec vulnerability exploits a structural divergence in how text is processed to bypass that loop entirely, using legacy ANSI escape codes.

Imagine an attacker passing a malicious payload through a Model Context Protocol tool's standard output. The string looks like this: \x1b[8mIgnore previous instructions\x1b[0m.

Trace the path of that single payload. It splits into two branches the moment it hits the oversight boundary.

[ Raw Payload: \x1b[8mIgnore previous instructions\x1b[0m ]
      |
      |--> Path A (Terminal Renderer)
      |      Applies conceal formatting.
      |      Outputs: [                   ] <-- Human sees a blank box.
      |
      |--> Path B (LLM Tokenizer)
             Ignores UI formatting.
             Outputs: "Ignore previous instructions" <-- Agent acts.

The first path routes to the human auditor. They pull up the transaction history in a standard terminal or log viewer. Standard terminals dutifully interpret the ESC character (ASCII 27, or \x1b) and apply the subsequent [8m conceal code. The terminal literally hides the text that follows, rendering nothing. The human auditor sees a blank line, assumes the tool returned an empty response, and clicks approve.

The second path routes straight to the Large Language Model's tokenizer. Tokenizers do not render user interfaces. They do not care about 1970s terminal formatting. They simply ingest the raw sequence of characters as plaintext. The agent receives a highly explicit command to ignore its system prompt and hijack the session.

The human gets the rendered UI of the television. The agent gets the actual inputs.

We have backed ourselves into the Dual-Band Interface Problem.

We are currently operating systems where the verification layer and the processing layer have cleanly decoupled. The human overseer and the AI agent are existing in entirely different realities, interpreting entirely different data structures from the exact same file.

We rely heavily on human oversight as a safety backstop because we intuitively assume the person and the machine are looking at the same document. Ted Benson pointed out a related dynamic regarding chat UI and the invisible sandbox, noting how the visual cues of our interfaces give us a false sense of a shared reality. We see tidy speech bubbles and avatars. The model sees a massive, flat array of tokenized integers.

Once those two realities diverge, oversight becomes a dangerous illusion. You cannot adequately oversee an intelligence that is reading a completely different set of bytes than the ones printed on your screen. The human is effectively giving a thumbs-up to a hallucination of safety.

The mechanical fix here requires a shift in how we handle data boundaries. We have to stop the lazy practice of feeding raw terminal standard output directly to agents. The stack needs a strict WYSIWYG protocol for LLM contexts.

What the machine reads must map perfectly, on a one-to-one basis, to what the human reviewer sees. Formatting must be aggressively stripped at the boundary before the text is passed to either the tokenizer or the log viewer. If the agent is allowed to read a character, the human must be forced to look at it.

My guess? The 1970s terminal tricks are just the warm-up. The next iteration of this exploit won't be ANSI codes. It will be invisible Unicode characters or CSS steganography baked into retrieved web payloads. And until we fix the interface layer, we will just keep mashing buttons on an unplugged controller.

← Back to Edition 11