Model output is attacker-influenced input; passing it unchecked to a browser, shell, database or URL fetcher turns prompt injection into XSS, command injection, SQL injection or SSRF.
- Treat model output as untrusted: encode it for the rendering context and never execute it directly.
- Replace free-form generated code, SQL or commands with narrow, parameterized operations that you validate.
- Apply the same output encoding, Content Security Policy and parameterization you use for user input.
Guides on this site
Keep generated output out of executable contexts
Choose safe rendering and narrow operations so model text cannot become browser code, database syntax or an unrestricted command.
Contain prompt injection at the application boundary
Assume retrieved content can influence model output; enforce data access and consequential actions in components the model cannot authorize for itself.
Call a hosted LLM API safely
A code-first checklist for wiring up an OpenAI or Anthropic API call from a backend: keep keys server-side, redact PII before prompts and logs, choose provider retention settings deliberately, validate structured output and still treat it as untrusted, and set timeouts, retries and per-user cost caps.
Contain LLM misinformation (OWASP LLM07:2026)
Stop plausible but wrong model output from driving decisions and actions: ground answers in sources, verify every citation, separate generation from execution with a claim-check-act pattern, gate consequential actions on a human, and evaluate factuality on your own domain.
Practice
- XSS lab: Render a model’s answer as text instead of active markup · Browser lab
- Run model-generated Python in a locked-down container · Local project
References
- LLM05:2025 Improper Output Handling (OWASP, 2025 edition)
- OWASP Top 10 for LLM Applications 2026 (OWASP GenAI Security Project resource page)
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.