Insecure output handling: LLM response to stored XSS

If model output is injected into the DOM as HTML, and any part of the prompt is attacker-controlled (a shared document, a username, a product), you can make the model emit active markup.

# attacker-controlled field that ends up in the prompt/context
Product name: Widget

The model echoes it, the app renders it unescaped.

// vulnerable sink
chatDiv.innerHTML = modelResponse;   // should be textContent or sanitized

Pro note: markdown renderers that allow raw HTML are the usual culprit. Prove it with a benign onerror beacon and note the exact sink. This is a classic web bug wearing an AI hat, so triage teams accept it readily when you show the unsanitized render path.