Yes, if untrusted text lands in a CSV or spreadsheet cell that starts with certain characters. OWASP describes CSV injection: spreadsheet programs treat cells beginning with an equals sign as formulas. An assistant that copies text from tickets, emails or web pages into a file can carry that content along unless the output is sanitized.
What CSV injection is
OWASP defines CSV injection, also called formula injection, as untrusted input embedded in CSV files. When a spreadsheet program opens the file, any cell starting with an equals sign is interpreted as a formula. OWASP lists three attack goals: hijacking the user's computer through spreadsheet software flaws, exploiting the user's habit of ignoring security warnings in files they trust, and exfiltrating contents from the spreadsheet or other open spreadsheets.
For an AI assistant, the untrusted input is not only what a user types. It is anything the assistant reads while building the file: a support ticket, an email subject line, a web page, a form submission. If that text goes into a cell unchanged, the file inherits the risk.
Which characters matter
OWASP says to ensure no cells begin with these characters: equals, plus, minus, at, tab, carriage return and line feed. It also notes full width variants of the formula characters that may be interpreted in some locales. And it warns that checking the start of the input is not enough, because separators and quotes can let an attacker begin a new cell with a dangerous character.
Sanitizing is trickier than it looks
OWASP offers common sanitization steps such as wrapping fields in double quotes, prepending a single quote, and escaping inner quotes. It also warns that these techniques are not reliable in Microsoft Excel after the file is saved and reopened, because Excel may remove quotes or escape characters. For files meant for human viewing in Excel, OWASP describes prefixing risky cells with a tab character inside the quoted field, and notes the trade-off that the tab stays in the underlying data and can affect later programmatic imports. Its summary: no universal sanitization strategy is safe for all spreadsheet applications and all downstream consumers.
So a vendor who says "we escape that" has made a claim worth testing, not a settled answer.
How to test an assistant
- Create a harmless test string that begins with an equals sign and does something visible but safe, such as a simple arithmetic expression.
- Put it in a place the assistant will read, like a ticket description in a test project.
- Ask the assistant to export a spreadsheet of tickets.
- Open the file in a spreadsheet program on a non-production machine.
- Check whether the cell shows your text or a calculated result.
- Save, close and reopen, then check again.
If the cell calculates, the product does not neutralize formulas. That is a finding to bring to the vendor, and a reason to restrict spreadsheet export or to open such files only in a safe viewer.
What buyers can ask for
| Request | Why |
|---|---|
| Description of output sanitization per format | Shows awareness of the issue |
| Option to export as plain text or JSON | Lowers formula risk |
| Warning on files built from untrusted sources | Informs the user |
| Admin policy to disable spreadsheet export | Containment |
| Test results or a reproducible method | Evidence over claims |
What teams can do today
Treat spreadsheets from an assistant like email attachments. Open them in a protected view, do not enable external content, and prefer formats without formulas for data handoffs. If your own systems consume the files, parse them as data, not through a spreadsheet application.
Safeguard's free scan at gold.safeguard.sh/scan covers dependency risk, which is a separate area from file content, but together with output controls it supports a layered review.
A worked example: the support ticket export
A support manager asks an assistant to export the week's tickets to a spreadsheet. One ticket was submitted through a public form, and its subject line begins with an equals sign followed by an expression. The assistant copies the subject into the cell as written. When the manager opens the file in a spreadsheet program, the cell may evaluate as a formula rather than display as text.
The text in the ticket is not the manager's, the assistant's or the company's. It came from an outsider and traveled through two trusted steps. This is the shape of the problem OWASP describes: untrusted input embedded in a file that another program interprets.
Step by step: reduce the risk without relying on one control
- Prefer a safer format for data handoffs. If people only need to read or sort data, a plain format without formulas avoids the issue.
- Neutralize risky cells when a spreadsheet is needed. OWASP lists the leading characters to watch and describes prefixing cells; for Excel it describes a tab character inside the quoted field, with a trade-off for later imports.
- Open files in protected view. Do not enable external content or links for a file whose origin you do not control.
- Keep spreadsheets from untrusted sources apart. Do not paste their content into internal workbooks that link to other data.
- Parse programmatically, not visually. When systems consume the file, read cells as data and avoid opening them in a spreadsheet application.
- Test the export path. Use the six step test above whenever a vendor changes the export feature.
Reading the OWASP guidance carefully
Two points are easy to miss. First, checking only the start of an input is not enough, since separators and quotes can start a new cell in the middle of the input. Second, the sanitization techniques are described as unreliable in Microsoft Excel after the file is saved and reopened. OWASP's own summary is that no universal approach is safe for every spreadsheet application and every downstream consumer. So a mitigation that passes your test today should be retested after a product update.
What to put in a vendor review
| Item | Evidence you want |
|---|---|
| Which formats the export supports | Documentation |
| How leading characters are handled | A test result you ran |
| Whether untrusted sources are flagged | Product behavior seen |
| How to disable spreadsheet export | An admin setting you found |
If a vendor answers vaguely, note it as unknown. A vendor that has already considered formula injection will usually answer quickly and specifically.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how controls map to evidence, and which records you would keep for your own review.
Quick check
Is adding a single quote enough to stop formulas?
Not reliably. OWASP notes such techniques can fail in Excel after saving and reopening the file.
Does this apply to CSV only?
The OWASP page focuses on CSV, but the same idea of untrusted text becoming executable content applies to any spreadsheet format that supports formulas.
Which team should own spreadsheet export controls?
Usually application security sets the rule and IT enforces it through settings and file handling. Name one owner so it does not fall between teams.
Sources
Last reviewed: 19 October 2026.
