# LLM Output XSS — Eliciting JavaScript Payloads from LLM for Browser Injection

- **Severity:** High
- **Signature ID:** `2274fe7b-e91c-4068-8432-c866e06a2998`
- **MITRE ATLAS:** AML.T0024 (Exfiltration via AI Inference API)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM02 (Sensitive Information Disclosure)

## Summary

This rule flags attempts to get an AI model to generate malicious JavaScript or HTML, such as script tags or event handlers, designed to steal cookies, session data, or page content when later rendered in a browser. It catches the request stage, before any such payload is actually used.

## How the attack works

An attacker sends a prompt asking the LLM to produce code containing script tags, event-handler attributes like onerror or onclick, javascript: URIs, or data:text/html URIs. The prompt combines this request with a goal like reading cookies, localStorage, sessionStorage, or the page's document body. If the LLM complies and its output is later inserted into a web page without sanitization, the generated code runs in a victim's browser and exfiltrates data. This rule only detects the request asking the LLM to generate the payload — it does not detect the payload being delivered or executed.

## Why it matters

If an application feeds LLM output directly into a web page, an attacker can use the model itself to author working cross-site scripting code, leading to session hijacking, credential theft, or exfiltration of page content from anyone who views the injected content.

## What you can do

- Never render LLM-generated HTML or JavaScript in a browser without strict sanitization and output encoding.
- Apply a content security policy that blocks inline scripts and event handlers regardless of their source.
- Treat any AI-generated code destined for a web page as untrusted input requiring the same review as user-submitted content.
- Log and review prompts that combine code-generation requests with references to cookies, storage, or document content.

## Known benign look-alikes

- Normal HTML form requests without malicious payload patterns
- Legitimate JavaScript event handler questions without exfil payload
- Marketing email template requests
- Educational questions about XSS prevention
- Legitimate CDN script tag generation
- Legitimate localStorage questions for user preferences

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00516

---
Source: https://www.netzilo.com/threats/atr-llm-output-xss-eliciting-javascript-payloads-from-llm-for-br