News for hackers. Stuff that matters.

A comment on ANSI escape injection in MCP servers: Hidden from humans, visible to AI. Parent comment

Re:ANSI escape injection in MCP servers: Hidden from humans,... by conartist6 on Thursday July 23, 2026 @07:56AM (#49020150)
Wh... wh... what? The problem is that ANSI escape codes aren't being stripped from text before processing, and you think a HUMAN should be doing that? That'd be like having a secretary hand-check every SQL query as it arrives at the database instead of using a query builder...
[ Parent | on HN ]
Re:ANSI escape injection in MCP servers: Hidden from humans,... by Rygian on Thursday July 23, 2026 @08:02AM (#49020222)
A human should defintely be doing that.

By "that" it is understood: enforcing that the code cleans up unsafe inputs before processing them.

If there is no human doing that enforcement, the code has no chance of being secure.

[ Parent | on HN ]
Re:ANSI escape injection in MCP servers: Hidden from humans,... by conartist6 on Thursday July 23, 2026 @08:07AM (#49020295)
Why! Do you use your eyeballs to spot SQL injection? Or do you maybe use a tool? A linter perhaps?
[ Parent | on HN ]
Re:ANSI escape injection in MCP servers: Hidden from humans,... by Rygian on Tuesday July 28, 2026 @08:29AM (#49082807)
I develop my code defensively, and I argue that the developers of MCP servers need to develop their code defensively too.

Not sure what it is that you intend to argue.

[ Parent | on HN ]