# AX-SYS-22: Never trust agent-generated markup in sensitive contexts

> Observability and governance · advanced · AX-SYS-22

Treat HTML or scripts produced by an agent as untrusted input, and render it safely to avoid injection and cross-site scripting.

## Why

Agents emitting raw HTML into a trusted page context is a direct XSS vector. This is the same foundational attack class as OWASP A03 (Injection), applied to AI-generated content: the output of a non-deterministic model cannot be treated as safe. Agent output is a known indirect-prompt-injection surface: untrusted content that flows back into a trusted page can carry hostile markup. Google's A2UI project was designed precisely to address this. Rather than rendering raw HTML from agents, it has them emit a declarative JSON description of UI components drawn from a trusted catalog, which the client maps to its own native widgets, so no agent-generated code is ever executed in the rendering context.

## Do

Sanitize or use a safe rendering protocol.

## Don't

Inject agent-produced HTML into a trusted page.

## Artifact

```js
// Never render agent-produced HTML directly into a trusted page.
// Bad:  element.innerHTML = agentOutput        // injection / XSS
// Bad:  <div dangerouslySetInnerHTML={{__html: agentOutput}} />
// Good: render through a sanitizer with a strict allowlist,
//       or a structured UI spec (for example Google's A2UI), not raw HTML.
const safe = sanitize(agentOutput, { allowedTags: ["b","i","a","p","ul","li","code"] });
```

## Citations

1. [OWASP Top 10 — A03: Injection / Cross-Site Scripting](https://owasp.org/www-project-top-ten/) — Injecting untrusted input directly into the DOM is the foundational XSS attack class; agent-produced HTML is untrusted input by definition and must be sanitized before rendering
2. [arxiv:2603.30016 — Architecting Secure AI Agents](https://arxiv.org/abs/2603.30016) — Agents emitting HTML or scripts that are rendered in a trusted page context create injection and XSS vectors; system-level structural separation of agent output from the trusted rendering context is required
3. [Google — Introducing A2UI: an open project for agent-driven interfaces](https://developers.googleblog.com/introducing-a2ui-an-open-project-for-agent-driven-interfaces/) — A2UI has agents emit a declarative JSON description of UI components from a trusted catalog rather than HTML or JavaScript, so no agent-generated code is executed in the rendering context

---
Source: Agent Experience Principles (axprinciples.com)