From Indirect Prompt Injection to DNS Exfiltration in macOS Terminal

Summary

Apple fixed a macOS Terminal behavior that let a crafted ANSI escape sequence trigger DNS requests, which could carry data out. The flaw was discovered by David Leadbeater, and the researcher showed it could be reached through an LLM-integrated CLI tool, where a malicious spreadsheet cell hijacked the model into emitting the sequence. Apple fixed the issue in macOS Tahoe 26.1, released on November 3, 2025.

Mitigation

Fixed in macOS Tahoe 26.1, released on November 3, 2025. The source also recommends that CLI tools encode control characters by default, using an approach similar to cat -v, with raw terminal output requiring explicit opt-in.

Topics

• Prompt injection and jailbreaks

Related items

• InfoConversational Gemini navigation comes to Apple CarPlaySame vendor · The Verge (AI)
• InfoMeta releases Muse Spark Open, a new ‘open-weight’ AI modelSame vendor · The Guardian Technology
• InfoMeta and Apple team up to make Muse AI models run better on MacsSame vendor · The Verge (AI)
• InfoApple and Meta team up to make Muse AI model run on Mac computers Same vendor · CNBC Technology
• InfoOpenAI accuses employee who left for Apple of leaking plans for unreleased deviceSame vendor · The Guardian Technology