A 311 LLM emits unsanitized HTML into the resident portal. What AppSec concern should the offensive AI assessment emphasize?
Select an answer to reveal the explanation.
Short Explanation
If the bot's answer gets dropped into the page as live HTML, you've crossed a trust boundary—the model text is acting like code. Treat generative output as untrusted until the portal sanitizes it.
Full Explanation
When a 311 LLM emits unsanitized HTML into the resident portal, the offensive AI assessment should emphasize LLM output trust-boundary failure: generative text is being rendered as active web content instead of treated as untrusted data. That collapse lets model output behave like code in the browser, creating classic client-side risk classes adjacent to XSS and undermining the assumption that chat answers are inert strings. Correct emphasis is output encoding, sanitization, and content-security controls at the portal boundary so civic pages never execute model-supplied markup. An adversary using statistical techniques to infer training-data properties describes a membership-inference attack, a different vulnerability class entirely from how generated text gets rendered as active content in the portal. Whether responses can be fingerprinted to identify the base model is a reconnaissance concern, not the output-rendering trust-boundary failure the unsanitized HTML demonstrates. Stored prompt injection risk when retrieved knowledge base entries influence model replies is a different vulnerability class; it concerns retrieved data manipulating model behavior, not unsanitized model output being rendered as active content in the browser. Exam caveat: the finding is about the rendering boundary and trust assumptions, not merely that the model can produce angle brackets; COASP-aligned reports classify the risk and required portal controls without providing browser exploit recipes against the live 311 site. Operational check: render LLM answers as text or sanitized Markdown, apply HTML sanitizers and CSP, ban innerHTML assignment for model strings in the 311 portal, add automated tests that inject markup-like model output into the render path, and include output-to-DOM checks in release gates before resident-facing deploys.