The only safe CORS spec is CORS. Have to treat everything the LLM is doing as malicious.

It’s actually worse than that though. An LLM is like letting attacker controlled content on the page inject JavaScript back into the page.