Lab: Exploiting insecure output handling in LLMs
Summary: A PortSwigger Web Security Academy lab demonstrates that an LLM chat feature which renders its output without encoding is vulnerable to XSS, since submitting the string <img src=1 onerror=alert(1)> to the live chat triggers an alert dialog. The lab shows indirect prompt injection working end to end: a review payload hidden in content the LLM is likely to repeat causes the model to emit an iframe that submits the account form, deleting the account of the user carlos when he asks the chat about the leather jacket.
Key Takeaway: The lab's first attempt failed because the LLM flagged the review as malformed or potentially harmful, and it only succeeded once the payload was wrapped in text the model would repeat - so a model's own anomaly detection is not a control you can rely on. An LLM that reads user-generated content and writes unencoded output into a page gives an attacker a path to actions like account deletion without ever touching the victim directly.
Read the original at PortSwigger Research ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026