curl can do evil things by itself due to terminal escape codes - a popular one was to set the title and then read the title back, which effectively types text into the terminal