Rendering the model's answer as HTML
A support UI renders the assistant's markdown answer as raw HTML. A knowledge-base article contains an image tag whose source points at an attacker's domain with conversation text appended — when the assistant quotes it, the browser fetches it and the conversation leaks.
The model's output is being treated as trusted because it came from your model. It didn't originate there: it's a function of your prompt, the user, and whatever the retriever pulled in.
Boundaries, outermost first: Attacker-influenceable: Retrieved docs (untrusted), Model Outside every boundary: SQL builder (another sink), Browser render (FAILED: exfiltrating), an empty slot for the at every sink Connections: Retrieved docs calls Model (step 1) Model calls at every sink — treat as untrusted (step 2) at every sink calls Browser render (step 3) at every sink calls SQL builder (step 4)