Say you ask your AI assistant to read a web page and sum it up. You skim the summary, it looks fine, you approve it. But the page carried instructions you couldn’t see — and your assistant quietly followed them.
That’s the short version of new research from the security firm Bright, published this week. It’s about a weak spot in MCP — the plug-in standard that lets AI assistants use tools like “fetch this page” or “read this file.” (If you’ve connected anything to Claude or ChatGPT lately, you’ve used MCP.)
The trick itself is old. Since the 1970s, terminals have used invisible control codes — called ANSI escape codes — to do things like change text colour or hide characters. A person reading the finished output only sees the effect, never the codes. An AI reads the raw text: every byte, including the parts meant to stay hidden. So an attacker can write instructions that are invisible to you but perfectly clear to the machine, then tuck them into anything your assistant fetches or reads. Bright showed two versions — a booby-trapped page the AI visits, and poisoned content saved now to be served up later.
This isn’t a lab-only worry. Mainstream developer tools like Kubernetes and Git have both been patched for the very same class of bug. And the danger is quiet: it isn’t your AI suddenly turning evil, it’s that the thing you approved on screen isn’t the thing it actually did.
The catch with giving an AI hands is simple. You can no longer assume you and it are reading the same page.