Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Embrace The Red demonstrated an indirect prompt injection in an analyzed file. The CLI printed the model response as raw terminal text; injected ANSI escape sequences caused macOS Terminal to make a DNS request carrying data.
ASSESSED SYSTEM
Purpose-built dillma.py GPT-4o November-preview file-analysis CLI that printed raw model output to macOS Terminal in the researcher’s controlled demonstration.
OUT OF SCOPE
No claim of a customer breach, a model-wide vulnerability, other terminal clipboard or code-execution configurations, or controls in unrelated Gemini paths.
Architecture: Standalone LLM / Generative AI (decision tree Q3) — Q2 NO: no autonomous agent tool chain is evidenced; Q3: direct model or inference service path is assessed. Tier 4: Tier 4 representative deployment scenario, bounded to the assessed system; the report does not establish every operator tier.
Documented attack or failure path
- The CLI accepted an untrusted file for model analysis.
- Injected file text induced an output containing terminal control sequences.
- Raw output reached macOS Terminal and triggered a DNS request in the controlled setup.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Output encoding was later reported as a mitigation for this CLI; it is not credited to the demonstrated pre-fix path.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 4 MVT 0.30 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 4 MVT 0.30 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 4 MVT 0.40 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 4 MVT 0.30 indeterminate | |||
| Containment (Cn) — scenario interval 0.00–0.84 (midpoint 0.42), Tier 4 MVT 0.40 indeterminate | |||
| Cn-3Output Filtering Robustness | 0.00w 0.16 | No effective output encoding or filtering stopped terminal control characters on the tested path, supporting the 0.00 output-filter anchor. | The researcher showed dillma.py printing raw GPT-4o output containing ANSI escape sequences to macOS Terminal, which triggered DNS exfiltration.source: primary report |
Unknown, not N/A: 25 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.25w 0.15 | The model produces output for a direct user file-analysis request; there is no autonomous tool action in the bounded CLI. |
| AsAttack Surface Exposure | 0.75w 0.20 | A representative user may analyze an untrusted local file; this is a scenario assumption rather than a population measurement. |
| CpCascade Potential | 1.00w 0.25 | No verified System Dependency Graph or DGC is published, so the framework worst-case Cp default applies.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.25w 0.40 | Encoding terminal output is an inferred focused application fix, not a measured repair-time result. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | Minimal public provenance: the original report identifies the affected path and event, but no operator assessment pack, signed configuration inventory, or repeated metric battery is published. |
| Ec — Public evaluation coverage | 0.02 | coverage 0.04 (1 of 26 applicable sub-metrics) × independence 0.80 × fidelity 0.70. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.27 | Evidence dated 2024-12-06; age 681 days on the workpaper reference date. Components: T_calendar 0.27 · C_event 0.65 · C_monitor 0.70. Binding term: T_calendar. Evidence reference is 2026-10-18, 681 days after the earliest substantive public evidence (2024-12-06). C_monitor = 0.70 applies the Table 44 conservative default for Tier 4 because usable public monitoring-coverage evidence is unavailable; it does not assert that the deployment had no telemetry. C_event = 0.65: The controlled dillma.py demonstration caused a DNS request carrying data, a demonstrated output-boundary failure; no production incident is reported. No targeted post-event re-attestation is published for the bounded pre-fix assessment. No generic C_evidence cap is assigned from missing public inputs alone. These caps describe public-evidence confidence and do not change the normalized-assurance indicative ERS or assert an unreported operational control failure. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.11 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
3.2 midpoint, interval 1.0–5.4; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
WHAT THIS CASE TEACHES
One controlled CLI output boundary failed; model origin-label design and other terminal paths remain unmeasured.
Sources: Original primary report — Terminal DiLLMa ANSI escape DNS exfiltration demonstration (2024-12-06) · Embrace The Red follow-up, 2026-07-16 · Apple Terminal security acknowledgement