Threat dossier · P2

Insecure output handling and terminal injection

Agents consume raw tool and command output as context while relaying it to a terminal the human trusts, so one poisoned response can address the model and the operator at the same time.

Direct answer

What is insecure output handling and terminal injection?

Insecure output handling is the failure to treat tool output, command results, and terminal rendering as untrusted input; hidden ANSI escape sequences and embedded instructions then steer the agent or deceive the operator reviewing its work.

Coverage statements below are limited to the current HOL Guard support contract and do not imply universal model or harness protection.

Copied text includes the canonical source and review date.
Reviewed Reviewer: HOL Guard EngineeringReview cadence: 30 days

Representative attack path

Defensive model only. This sequence omits weaponized payloads and is not attributed to a specific incident unless a source explicitly says so.

  1. Step 1

    A tool result, command output, or fetched document contains hidden escape sequences or instructions.

  2. Step 2

    The terminal renders the malicious content while the model reads the raw text.

  3. Step 3

    The agent treats the embedded instructions as authoritative next steps.

  4. Step 4

    A consequential follow-on action is requested.

Coverage boundary

What this control can cover

  • Consequential follow-on actions remain eligible for runtime policy even when triggered by poisoned output.
  • Supported MCP and tool configuration can be reviewed separately.

What it does not prove or prevent

  • Sanitizing or filtering terminal rendering of tool output.
  • Detecting every hidden sequence inside the model’s context window.

Policy pattern

Policy pattern for insecure output handling and terminal injection

Keep untrusted context or overbroad autonomy from becoming unconditional execution authority on supported action surfaces.

Use when: Agents consume raw tool and command output as context while relaying it to a terminal the human trusts, so one poisoned response can address the model and the operator at the same time.

Decision pattern

  1. Identify the trust boundary and consequential action class.
  2. Apply least privilege and the narrowest supported policy.
  3. Require review for sensitive or ambiguous actions.
  4. Preserve only redacted, versioned evidence needed to reproduce the decision.

Limitations

  • Sanitizing or filtering terminal rendering of tool output.
  • Detecting every hidden sequence inside the model’s context window.

If you suspect prompt injection

  1. Step 1

    Response 1

    Stop downstream actions and capture the raw output for review.

  2. Step 2

    Response 2

    Inspect the source that produced the payload.

  3. Step 3

    Response 3

    Treat rendered terminal text as untrusted during review.

  4. Step 4

    Response 4

    Retest with a safe fixture and tightened policy.

Sources and mappings

Related dossiers

Neighboring threat classes that share attack paths or trust boundaries with this dossier.