Treat everything a model produces as untrusted input to the next system. Validate it, encode it for the context where it lands, and use parameterized queries for databases. Because prompts shape output, a user can reach downstream functions indirectly through the model unless you check what comes out.
The weakness in OWASP's words
OWASP LLM05:2025, Improper Output Handling, is the failure to validate, sanitize and handle LLM output before it reaches other components. Since prompts can steer output, it gives users indirect access to downstream functionality. Consequences include XSS, CSRF, SSRF, privilege escalation and remote code execution.
Risk rises when the model has more privilege than the end user should, when indirect prompt injection is possible, when third party extensions skip input validation, when output encoding does not match the context, and when monitoring and rate limiting are weak.
OWASP's example scenarios
- An extension passes unvalidated model output to a privileged admin function and shuts something down.
- A summarizer follows injected instructions and sends sensitive data to an attacker's server.
- A chat to SQL feature produces a query that drops all tables because nobody reviews it.
- A web app renders unsanitized model output, and a crafted prompt runs script in victims' browsers.
- Generated marketing email templates include malicious script.
- Generated code exposes data, introduces SQL injection or suggests nonexistent packages that an attacker could register with malware.
What to do in an agent pipeline
An agent chains steps, so output from one step becomes input to the next. Put a check at every boundary.
- Zero trust: treat the model as any other user and validate its response before it reaches backend functions.
- Encode for context: HTML encoding for web content, proper escaping for SQL, and so on. Follow OWASP ASVS guidance for validation and output encoding.
- Parameterize: use prepared statements for any database operation involving model output. Never concatenate it into a query string.
- Add a Content Security Policy to limit XSS from generated content.
- Log and monitor model outputs for patterns that suggest exploitation.
- Review generated code and verify suggested packages exist and are legitimate before use.
Tool arguments are output too
When an agent calls a tool, the arguments are model output. A file path argument may contain traversal sequences. A URL argument may point to an internal host. A shell argument may carry a second command. Validate tool inputs on the tool side, as the MCP specification says servers must do, rather than trusting the caller to have been careful.
A small review
- Find every place model text is rendered in a page, run as code, or placed in a query.
- For each, name the encoding or validation that sits in front of it.
- If you cannot name one, that is the bug.
Where Safeguard fits
Safeguard includes SAST code scanning, dependency scanning and a free scan at https://gold.safeguard.sh/scan. They can help catch injection patterns and risky packages in generated code before it ships.
Quick check
Is output handling only a chatbot problem?
No. Agents pass model output to tools, databases and other agents, so each of those handoffs needs validation.
Sources
Last reviewed: 19 October 2026.
