[mschuster91]

> Shouldn't it be relatively simple to strip ANSI escape sequences from data originating from MCP connections?

The problem is, literally anything can be malicious for an AI. With SQL? Prepared statements are foolproof, no matter what garbage I put into a buffer destined to be stored in a BLOB, there is no way of this leopard biting my face.

As long as there is no separation between prompt, context and unsafe input in LLMs (which I doubt is possible), any LLM is vulnerable to injection attacks. Even if you place a second LLM to filter input for the actual agent LLM, a two-stage exploit can be used (and so on and so on).

[Gormo]

Why wouldn't there end up being a separation between prompt and context, though? Why can't we set up LLM engines to have one input stream for instructions and another input stream for data? We've got lots of effective approaches to mitigate the analogous issues that come from storing data in the same memory that we execute code from.