A Content Security Policy (CSP) is an HTTP header that tells the browser which sources of scripts, styles, images, and other resources it is allowed to load and run. By allowing only trusted origins and blocking inline script by default, a good CSP sharply reduces the damage a cross-site scripting bug can do, because injected script simply will not execute.
What it controls
A CSP is a set of directives, for example script-src to say where scripts may come from, and frame-ancestors to say who may frame your page. The browser enforces them, refusing to load or run anything outside the allowed sources, which turns a class of injection attacks into a non-event.
Why it is hard to add later
A strict CSP can break existing inline scripts and third-party widgets, so it is far easier to design in from the start than to retrofit. Many teams start in report-only mode, which logs violations without blocking, then tighten the policy once they see what breaks.
What this means for AI-generated code
AI-generated apps almost always ship with no CSP, since the app runs fine without one. That means an XSS bug, which these tools also introduce, has nothing standing in its way once it lands.