> Shouldn't it be relatively simple to strip ANSI escape sequences from data originating from MCP connections?

The problem is, literally anything can be malicious for an AI. With SQL? Prepared statements are foolproof, no matter what garbage I put into a buffer destined to be stored in a BLOB, there is no way of this leopard biting my face.

As long as there is no separation between prompt, context and unsafe input in LLMs (which I doubt is possible), any LLM is vulnerable to injection attacks. Even if you place a second LLM to filter input for the actual agent LLM, a two-stage exploit can be used (and so on and so on).