Output Handling & Excessive Agency

Developers who would never innerHTML a form field will happily innerHTML a model response, because it "came from our AI." The model is a text generator influenced by attacker-controllable context. Not a trusted component.

Output flows into	Classic bug	Fix
innerHTML / markdown	XSS	Contextual encoding, sanitise
eval / generated code	RCE	Never auto-execute; sandbox
SQL string	SQLi	Parameterised — model supplies values, never SQL
Shell command	Command injection	execFile with an arg array
Model-supplied URL	SSRF	Host allow-list; block internal ranges
Auto-fetched markdown image	Data exfiltration	Don't auto-fetch remote content

Nothing in that column is AI-specific. The AI is a new source of untrusted data, not a new sink.

Excessive agency — three failures: excessive permissions (credential too broad), excessive functionality (run_sql(query) when you need get_order(id)), excessive autonomy (acts irreversibly without confirmation).

Design so that a fully compromised model still can't do serious damage. Assume injection succeeds; ask what it buys. If the answer is "everything," the tool design is wrong — not the prompt.

Authorization never belongs in the model. Asking it to "only show the current user's data" isn't access control; it has no reliable notion of identity and can be argued with. Enforce in the tool, from the session identity.