Apple Fixes macOS Terminal Flaw That Let AI Tools Be Tricked Into Leaking Data via DNS

Apple has fixed a macOS Terminal behaviour that could be abused to leak data through DNS requests. Security researcher Johann Rehberger of Embrace The Red reported the issue, following his earlier Terminal DiLLMa research. The behaviour was first found by David Leadbeater: a special sequence of ANSI escape codes (hidden control characters that tell a terminal how to behave) could make the Terminal app send a DNS request.

The risk grew with AI. Researcher Leon Derczynski found that large language models can emit escape characters. Rehberger saw that this could let an attacker hijack AI agents and command-line AI tools, then use the DNS behaviour to pull data out. He built an end-to-end demonstration in December 2024 and shared it with Apple, which has since mitigated the DNS exfiltration route and credited him in its release notes.

The wider problem remains. Rehberger notes that AI-connected command-line tools often pass escape characters straight to the terminal without handling them safely. Depending on the terminal in use, this could cause other unwanted behaviour. His recommendation is that tools should safely encode control characters by default, similar to the cat -v approach, and only allow raw terminal output when a user explicitly opts in. This summary covers only the opening of the original article.