- ANSI escape sequences are control codes that hide instructions from humans but are visible to AI models, enabling injection attacks.
- Two attack variants: direct-fetch AESI (attacker hosts content with hidden instructions) and stored AESI (payload written to storage, later read by model).
- Security impact includes unauthorized agent actions, human-in-the-loop bypass, log manipulation, and persistent injection risk.
- DAST automates detection by inspecting raw bytes, focusing on model-consumable fields, using unique markers, and applying a three-signal confirmation rule.
- Detection pipelines for direct-fetch and stored AESI involve probe, map reflections, and attack/confirm phases.
- Defenses: sanitize control bytes, validate ingestion, treat all external text as untrusted, and scan continuously with byte-level, field-aware detection.