Commentary on X
Models can output invisible characters than run on your computer when simply viewed - in your terminal, or editor, or many other places. Printing output in Cursor or tailing a log can cede control. This is officially recognized in a CWE entry describing the general weakness - and I found it, so there's a credit way down the page! I don't spend the majority of my time as a security practitioner so really happy for this recognition, and thanks to Erick Galinkin for guiding this in and connecting all the dots as a validated CWE contribution, and thanks to STÖK for highlighting this weakness STILL applied in 2024. https://cwe.mitre.org/data/definitions/150.html