Dangerous Reactivity: Why AI Output Is the New XSS

Abstract

Vue developers know one golden rule: never use v-html on user input. This or something similar is well-known in other frameworks, too. Yet, as we're integrating Large Language Models (LLMs) into our applications, we often make a fatal mistake. We're treating AI output as a trusted source. This is fine, right? Well, not automatically.

Let's look at OWASP LLM05 and how "Improper Output Handling" impacts the security of our components. Therefore, let's discuss examples where safe inputs can trick models, causing vulnerabilities like XSS and injection attacks. By the end, you'll learn how to be "professionally pessimistic" for AI. You'll learn how to sanitize LLM data, safely render Markdown, and manage AI-generated content. Join my session to approach technology with caution, I look forward to exploring this with you!

Slides

Recording