alt Hacker News> By design there is no separation between control & data channels in LLMs.
No? MCP integrations are certainly different channels than the prompt stream input by the user. They're usually interface layers that connect to traditional REST APIs and/or CLI tools, and are exposed to the LLM by the agent software, all of which is deterministic code.
Shouldn't it be relatively simple to strip ANSI escape sequences from data originating from MCP connections? Or alert users to their presence, or have granular approval rules that trigger when ANSI sequences are detected?
> Shouldn't it be relatively simple to strip ANSI escape sequences from data originating from MCP connections?
The problem is, literally anything can be malicious for an AI. With SQL? Prepared statements are foolproof, no matter what garbage I put into a buffer destined to be stored in a BLOB, there is no way of this leopard biting my face.
As long as there is no separation between prompt, context and unsafe input in LLMs (which I doubt is possible), any LLM is vulnerable to injection attacks. Even if you place a second LLM to filter input for the actual agent LLM, a two-stage exploit can be used (and so on and so on).