tanstack-ai-core-ag-ui-protocol

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the “Receiving AG-UI RunAgentInput on the Server” POST handler, the server parses client-submitted params.messages (from chatParamsFromRequestBody(await req.json())) and passes messages into chat(), meaning outsider-authored free text in RunAgentInput.messages is directly ingested at runtime without selecting a specific item.