"cat readme.txt" is not safe if you use iTerm2

Scope and nature of the bug

• The issue is in iTerm2’s SSH integration, not in cat itself. Any program that prints attacker-controlled bytes to the terminal could trigger it.
• iTerm2 multiplexes a special “conductor” control protocol over the same text stream as shell output. It fails to distinguish between trusted conductor data and untrusted terminal output, so a crafted file/server banner can impersonate the conductor.
• This can be one link in a larger exploit chain, but on its own the scenario is somewhat contrived; several commenters call the “cat readme.txt is not safe” framing sensational.

Disclosure timing and AI’s role

• Some argue the post was premature because the fix hadn’t reached stable releases and the blog adds more exploit detail than the upstream commit.
• Others respond that once a security-relevant commit is public, attackers can (and did) have LLMs rediscover and weaponize the bug quickly, so delaying public explanation doesn’t help much.
• There’s debate over whether AI shortens the time from patch commit to active exploitation, pushing toward faster patch cycles and possibly shorter embargoes.

Terminals, in‑band control, and design flaws

• Many see this as yet another example of the longstanding risk of mixing control sequences and data in the same text stream (akin to ANSI bombs, SQL injection, XSS, prompt injection).
• Some argue terminals should remain “dumb” and never interpret output beyond basic display; others want rich features (colors, clickable paths, SSH integration, AI helpers) and acknowledge this increases attack surface.
• Several propose better designs: out‑of‑band control channels (e.g., PTY or SSH extensions), GUI/graphics-based protocols, or “semantic”/graphical terminals that render structured data instead of raw escape codes. Backward compatibility and economics are seen as major barriers.

History, alternatives, and mitigations

• Commenters recall older terminal and modem exploits (keyboard remapping, ANSI.SYS, +++ATH0) as prior art; “never cat untrusted files” is described as an old norm.
• Some suggest safer habits: view untrusted files with pagers/editors, or alias cat to strings/cat -v; use reset/stty sane when escape codes corrupt the terminal.
• Several recommend avoiding iTerm2’s SSH integration or using simpler terminals (e.g., platform defaults, Ghostty, WezTerm) that keep integrations optional and modular.
• There’s concern about repeated iTerm2 SSH-related CVEs and a broader worry that complex “smart” terminals, especially from small teams, will keep hitting similar bugs.