Vercel AI SDK Attack Probe

Authorized self-test for apps using the Vercel AI SDK. Follow shared probing conventions — discover endpoint via env or app/api/chat/route.ts, app/api/completion/route.ts, etc. Default Next.js port 3000. Pair with prompt-injection-probe.

Vercel-AI-SDK-specific attack surface

• useChat endpoints are typically POSTs to /api/chat with { messages: CoreMessage[] }. They're often public — auth left as "TODO".
• streamText({ tools: { x: tool({ execute }) } }) runs execute with the model's chosen args. The SDK enforces the zod schema, but z.string() is a wide-open hole if not narrowed (z.enum, regex).
• experimental_attachments (image/files passed by useChat) are forwarded to the model unless the route handler validates size/MIME.
• Output rendering: many demos pipe streamText output into <ReactMarkdown> with HTML enabled, or directly into dangerouslySetInnerHTML. Prompt-injected markdown becomes XSS.
• onFinish callback often pipes content to remote telemetry — leakage vector.

Payloads