# Web Injection via XSS Payload and onerror Event Handler

- **Severity:** High
- **Signature ID:** `bb8c894b-0127-4149-a17b-a861c3cde422`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.000 (Direct)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

An AI agent that fetches and displays web content can be fed pages containing classic cross-site scripting tricks, such as broken image tags with malicious onerror handlers. If the agent renders or passes that content along without filtering, the payload can execute in whatever context receives it.

## How the attack works

An attacker plants content on a web page, in a document, or in a data source that the AI agent will read as part of its task, such as summarizing a page or answering questions about it. The content contains XSS techniques: onerror or onload event handlers, IMG or SCRIPT tags, HTML-entity-encoded links, javascript: URIs, or String.fromCharCode-encoded strings meant to slip past simple filters. The agent fetches this content and either renders it directly or relays it to a downstream user interface. If the rendering surface executes HTML/JS, the payload runs.

## Why it matters

If the agent's output is displayed in a browser or any HTML-rendering surface, this can lead to script execution, session hijacking, or delivery of further malicious content to whoever views the agent's output.

## What you can do

- Sanitise and strip HTML/JS from any web content before it reaches a rendering surface, regardless of source trust.
- Treat agent-fetched web content as untrusted input and never render it as raw HTML without escaping.
- Apply a strict Content Security Policy to any interface that displays agent output.
- Log and review cases where agents relay content containing event handlers, script tags, or encoded payloads, but expect some false positives from security education or code-sample content.

## Known benign look-alikes

- Security education content discussing web injection techniques
- Web development code samples containing sanitised HTML examples
- CTF or penetration testing reports with example payloads

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00498

---
Source: https://www.netzilo.com/threats/atr-web-injection-via-xss-payload-and-onerror-event-handler