Keep AI-generated CSV exports from becoming spreadsheet formulas

Define the destination before the escape function

An assistant produces an inventory table. A label that looks ordinary in a browser can acquire different meaning when a spreadsheet imports it. OWASP's CSV Injection guidance describes formula interpretation risks and warns that no CSV sanitization strategy is safe for every spreadsheet and downstream consumer.

First decide what the export is for: a human spreadsheet workflow, a machine importer with a defined schema, or a plain-text review. Name the applications, import paths and versions the team intends to support. A direct-open action and an import wizard may use different settings. This guide proposes a harmless synthetic review; no spreadsheet was opened, formula evaluated, external destination contacted or export experiment run.

Keep field syntax separate from cell meaning

RFC 4180 documents common CSV syntax, including quoting fields containing commas, quotes or line breaks and doubling embedded quotes. It is an Informational RFC, not a universal spreadsheet security standard. Correct serialization prevents one label from accidentally becoming extra columns. It does not assign a spreadsheet text type to that label.

Use a maintained CSV writer for the chosen dialect rather than concatenating model text with commas. Validate the intended columns and numeric ranges before serialization. Then apply the selected consumer policy to untrusted textual fields. Evaluate final parsed cells, including headers if they can contain model text, rather than screening only the beginning of the complete response.

OWASP identifies formula-leading characters and control characters as relevant cases. It also notes that save-and-reopen behavior can defeat some escaping approaches. Do not make a universal promise from a rule that prefixes every suspicious string with one apostrophe, tab or space.

Use a small synthetic inventory fixture

The fictional export has item_id as an identifier, label as untrusted text, quantity as an integer and unit_price as an allowed signed decimal. The business schema permits a negative price adjustment. These sample bytes contain no external URL, external function or customer information.

item_id,label,quantity,unit_price
0017,=1+1,2,12.50
0018," +DEMO",0,-3.00
0019,"Widget, ""Demo""",3,0.00

The arithmetic-looking label is a test string, not an intended formula. The following matrix defines desired outcomes for a supported import policy; it reports no observed importer behavior.

A rule that converts every negative number into text can break the intended adjustment workflow. Distinguish validated numeric fields from arbitrary labels that happen to begin with a sign. Keep the expected schema independent of the model's suggested column types.

Choose an importer policy the team can actually support

LibreOffice's Text Import documentation describes explicit column types, a quoted-field-as-text option and an Evaluate formulas option. It also documents number detection, language-dependent numeric interpretation and trimming. These are concrete configuration choices for that importer, not evidence that another application's automatic open path behaves identically.

For a controlled spreadsheet workflow, specify textual columns and formula handling while preserving declared numeric columns. If the team instead produces a typed workbook, require the writer to store untrusted labels as explicit strings rather than infer formulas; inspect the resulting cells with the supported reader. A different file extension alone is not protection.

If recipients or settings cannot be bounded, avoid presenting the CSV as universally safe to open. Offer an appropriate controlled preview or a machine-oriented format with a documented schema, and explain the supported workflow. That choice does not control what happens after someone copies data into another tool.

Check round trips and positive usefulness

A proposed acceptance run would inspect the exported bytes, parsed column count, imported cell types, stored values and formula status. Use the named importer configuration with formula evaluation disabled for these test strings; a safe inspection must not depend on executing the candidate formula to see its result. If inspection itself cannot be performed without evaluating untrusted content, hold that path and use a safer method.

Then save and reopen through the supported workflow and repeat the checks. Keep the application version, locale, delimiter, encoding, column settings and round-trip format with the evidence. A screenshot showing “2” cannot distinguish a literal value from a calculated result. Include numeric usability as well as rejection: legitimate quantities and adjustments must remain usable.

A library update, new export field or second spreadsheet application changes the acceptance scope. Preserve each configuration's results separately. This matrix is still unrun and provides no claim that any importer passed.

Keep the export claim narrow

This boundary differs from safe browser rendering and file access control: the risk comes from a downstream application's interpretation of cell content. Authorization to download a file does not settle that interpretation.

Boundary's planned request router does not provide a CSV sanitizer or spreadsheet inspection service. Its eight mock policy checks are separate evidence. A useful export claim names the tested format, importer and settings, preserves needed data types, and leaves unexamined consumers explicitly outside that evidence.