Never trust agent-generated markup in sensitive contexts

Treat HTML or scripts produced by an agent as untrusted input, and render it safely to avoid injection and cross-site scripting.

Why

Agents emitting raw HTML into a trusted page context is a direct XSS vector. This is the same foundational attack class as OWASP A03 (Injection), applied to AI-generated content: the output of a non-deterministic model cannot be treated as safe. Agent output is a known indirect-prompt-injection surface: untrusted content that flows back into a trusted page can carry hostile markup. Google's A2UI project was designed precisely to address this. Rather than rendering raw HTML from agents, it has them emit a declarative JSON description of UI components drawn from a trusted catalog, which the client maps to its own native widgets, so no agent-generated code is ever executed in the rendering context.

Do

Sanitize or use a safe rendering protocol.

Don't

Inject agent-produced HTML into a trusted page.

Artifact

// Never render agent-produced HTML directly into a trusted page.
// Bad:  element.innerHTML = agentOutput        // injection / XSS
// Bad:  <div dangerouslySetInnerHTML={{__html: agentOutput}} />
// Good: render through a sanitizer with a strict allowlist,
//       or a structured UI spec (for example Google's A2UI), not raw HTML.
const safe = sanitize(agentOutput, { allowedTags: ["b","i","a","p","ul","li","code"] });