Add security comments for GetResponseAsync/GetStreamingResponseAsync

src/Libraries/Microsoft.Extensions.AI.Abstractions/ChatCompletion/IChatClient.cs

@@ -33,6 +33,22 @@ public interface IChatClient : IDisposable
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
     /// <returns>The response messages generated by the client.</returns>
     /// <exception cref="ArgumentNullException"><paramref name="messages"/> is <see langword="null"/>.</exception>
+    /// <remarks>
+    /// Prompt <paramref name="messages"/> are passed through to the underlying provider, and the <see cref="ChatResponse.Messages"/>
+    /// in the <see cref="ChatResponse"/> are returned without modification or filtering.
+    /// <para>
+    /// No prompt injection defense is performed for data within <paramref name="messages"/>.
+    /// Callers are expected to implement guards against prompt injection attacks as needed.
+    /// </para>
+    /// <para>
+    /// There are no limits or restrictions imposed on data sizes sent to the underlying provider or returned from it.
+    /// Callers are expected to apply data size limits as needed.
+    /// </para>
+    /// <para>
+    /// There are no limits or restrictions imposed on the number of messages sent to the underlying provider or returned from it.
+    /// Callers are expected to apply rate limits on a per-user or per-session basis as needed.
+    /// </para>
+    /// </remarks>
     /// <related type="Article" href="https://learn.microsoft.com/dotnet/ai/microsoft-extensions-ai#request-a-chat-response">Request a chat response.</related>
     Task<ChatResponse> GetResponseAsync(
         IEnumerable<ChatMessage> messages,
@@ -45,6 +61,22 @@ Task<ChatResponse> GetResponseAsync(
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
     /// <returns>The response messages generated by the client.</returns>
     /// <exception cref="ArgumentNullException"><paramref name="messages"/> is <see langword="null"/>.</exception>
+    /// <remarks>
+    /// Prompt <paramref name="messages"/> are passed through to the underlying provider, and the <see cref="ChatResponse.Messages"/>
+    /// in the <see cref="ChatResponse"/> are returned without modification or filtering.
+    /// <para>
+    /// No prompt injection defense is performed for data within <paramref name="messages"/>.
+    /// Callers are expected to implement guards against prompt injection attacks as needed.
+    /// </para>
+    /// <para>
+    /// There are no limits or restrictions imposed on data sizes sent to the underlying provider or returned from it.
+    /// Callers are expected to apply data size limits as needed.
+    /// </para>
+    /// <para>
+    /// There are no limits or restrictions imposed on the number of messages sent to the underlying provider or returned from it.
+    /// Callers are expected to apply rate limits on a per-user or per-session basis as needed.
+    /// </para>
+    /// </remarks>
     /// <related type="Article" href="https://learn.microsoft.com/dotnet/ai/microsoft-extensions-ai#request-a-streaming-chat-response">Request a streaming chat response.</related>
     IAsyncEnumerable<ChatResponseUpdate> GetStreamingResponseAsync(
         IEnumerable<ChatMessage> messages,