Markdown rendering is enabled for AI response surfaces

When AI response text is injected directly into the DOM via plain string interpolation, every **bold**, ## heading, and `code block` in the model's output renders as raw punctuation — a UX failure that signals a half-finished integration. Worse, some models emit markdown-formatted content specifically because they are prompted or fine-tuned to do so; stripping rendering creates a mismatch between what the model produces and what the user sees. OWASP LLM05 identifies trust and safety failures in output presentation as a category of harm; showing raw syntax characters where formatted prose was intended degrades user trust and undermines the inference-contract between model and interface.

Install react-markdown with GFM support and replace any plain string interpolation of AI output:

import ReactMarkdown from 'react-markdown'
import remarkGfm from 'remark-gfm'

// Replace: <p>{message.content}</p>
<ReactMarkdown remarkPlugins={[remarkGfm]}>
  {message.content}
</ReactMarkdown>

For streaming responses, wrap in a component that buffers partial tokens before passing them to the renderer to avoid mid-token syntax artifacts.