diff --git a/static/panels.js b/static/panels.js
index 8ebf44d6..ca7e6733 100644
--- a/static/panels.js
+++ b/static/panels.js
@@ -5569,7 +5569,7 @@ async function loadProvidersPanel(){
       list.appendChild(_buildProviderCard(p));
     }
   }catch(e){
-    list.innerHTML='<div style="color:var(--error);padding:12px;font-size:13px">Failed to load providers: '+e.message+'</div>';
+    list.innerHTML='<div style="color:var(--error);padding:12px;font-size:13px">Failed to load providers: '+esc(e.message||String(e))+'</div>';
   }
 }
 
diff --git a/static/ui.js b/static/ui.js
index 0c716cb8..f270909f 100644
--- a/static/ui.js
+++ b/static/ui.js
@@ -1206,7 +1206,7 @@ function renderModelDropdown(){
           }
         }
         const badgeHtml=m.badge?`<span class="model-opt-badge model-opt-badge--${esc(m.badge.role||'configured')}">${esc(badgeLabel)}</span>`:'';
-        row.innerHTML=`<div class="model-opt-top"><span class="model-opt-name">${esc(modelName)}</span>${badgeHtml}</div><span class="model-opt-id">${m.id}</span>`;
+        row.innerHTML=`<div class="model-opt-top"><span class="model-opt-name">${esc(modelName)}</span>${badgeHtml}</div><span class="model-opt-id">${esc(m.id)}</span>`;
         row.onclick=()=>selectModelFromDropdown(m.value);
         dd.appendChild(row);
       }
@@ -1234,7 +1234,7 @@ function renderModelDropdown(){
       const badgeHtml=m.badge?`<span class="model-opt-badge model-opt-badge--${esc(m.badge.role||'configured')}">${esc(m.badge.label||'Configured')}</span>`:'';
       // Inline provider chip on every row that has a group (#1425)
       const providerChip=m.group?`<span class="model-opt-provider">${esc(m.group)}</span>`:'';
-      row.innerHTML=`<div class="model-opt-top"><span class="model-opt-name">${m.name}</span>${badgeHtml}${providerChip}</div><span class="model-opt-id">${m.id}</span>`;
+      row.innerHTML=`<div class="model-opt-top"><span class="model-opt-name">${esc(m.name)}</span>${badgeHtml}${providerChip}</div><span class="model-opt-id">${esc(m.id)}</span>`;
       row.onclick=()=>selectModelFromDropdown(m.value);
       dd.appendChild(row);
     }
diff --git a/tests/test_model_picker_escaping.py b/tests/test_model_picker_escaping.py
new file mode 100644
index 00000000..76fcd44e
--- /dev/null
+++ b/tests/test_model_picker_escaping.py
@@ -0,0 +1,20 @@
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_model_picker_escapes_provider_supplied_model_labels():
+    src = (ROOT / "static" / "ui.js").read_text()
+
+    assert '<span class="model-opt-id">${esc(m.id)}</span>' in src
+    assert '<span class="model-opt-name">${esc(m.name)}</span>' in src
+    assert '<span class="model-opt-id">${m.id}</span>' not in src
+    assert '<span class="model-opt-name">${m.name}</span>' not in src
+
+
+def test_providers_panel_escapes_load_error_text():
+    src = (ROOT / "static" / "panels.js").read_text()
+
+    assert "Failed to load providers: '+esc(e.message||String(e))+'" in src
+    assert "Failed to load providers: '+e.message+'" not in src