Topic starter
18/08/2026 2:50 pm
TL;DR: AI-generated code can execute before humans review it, and Appknox says a Gemini XSS flaw showed how auto-rendering, weak sanitisation, and permissive sandboxing can turn trusted output into zero-click execution. The broader lesson is that application security now has to govern runtime behaviour, not just pre-release code, according to Appknox.
Editorial analysis by NHI Mgmt Group, based on content published by Appknox: “Gemini XSS Vulnerability: When AI Executes Malicious Code”.
Key questions
Q: What breaks when AI-generated code is allowed to render automatically?
A: The main failure is that generation and execution become indistinguishable.
Q: Why do live previews create more risk than static code review in AI tools?
A: Live previews create risk because they execute content in context, while static review only inspects code before runtime.
Q: What signals show that AI runtime controls are failing?
A: Warning signs include unexplained tool usage, access to data outside the expected workflow, repeated policy overrides, and behavioural drift across sessions.
Practitioner guidance
- Harden preview and canvas execution surfaces Treat any live preview, code canvas, or auto-rendering pane as an execution environment.
- Validate against the rendered form, not the source string Test sanitisation after parsing, encoding, and browser interpretation, because a payload that looks safe in source form may execute differently once the browser resolves tags, attributes, and entities.
- Separate generation from execution Require an explicit approval step before AI-generated HTML, JavaScript, or other active content can render in a trusted context.
Bottom line: AI code generators can create execution risk when live previews render output before review, which means the control point has moved from static code inspection to runtime governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:32 pm
Zero-click execution is now an application security problem, not a niche AI bug. When AI tools render and execute code automatically, the security model moves from static review to runtime control. That changes what AppSec has to protect, because the dangerous event is not code being written, but code being executed before review. Practitioners should reframe AI code generation as an execution governance problem.
A question worth separating out:
Q: How should teams govern AI systems that can take actions as well as generate outputs?
A: Treat the agent as a governed actor, not just a model output stream. Require action-level logging, tool-call traceability, authorization boundaries, and approval gates before the system can write to records or invoke downstream tools. If an AI system can change state, its authority must be scoped, monitored, and revocable like any other privileged non-human identity.
👉 Read our full editorial: Google Gemini XSS exposes the limits of AI code execution controls