Improper Output Handling in LLMs
The dangerous moment often isn’t the model — it’s what your code does with the model’s answer. Improper output handling (OWASP LLM10:2026) is trusting LLM output as safe and feeding it straight into a browser, a shell, a database or an interpreter, where it becomes classic injection: XSS, SQLi, command execution, SSRF.
Test only systems you own. Chaining LLM output into an injection is a real vulnerability class — demonstrate it against your own app or one you are authorised to assess, never a live third-party service.
What it is
Treat everything a model emits as untrusted user input, because effectively it is: an attacker who can influence the prompt (see prompt injection) can influence the output. If that output is rendered, queried, or executed without the same encoding and validation you’d apply to any user input, you have handed the attacker a channel straight into your downstream systems. In the 2026 list this dropped from #5 to #10 — not because it got safer, but because newer agentic risks climbed above it.
The threats
Where it shows up in practice.
| Threat | How it works |
|---|---|
| Cross-site scripting (XSS) | Model output containing HTML/JS is rendered in a page unescaped, running attacker script in the victim’s browser. |
| SQL injection | Output interpolated into a query instead of parameterised, letting crafted text alter the SQL. |
| Command / code execution | Output passed to a shell, eval, or a template engine and executed on the server. |
| SSRF & path traversal | A model-supplied URL or path is fetched or opened without validation, reaching internal services or files. |
| Markdown / link injection | Malicious links or images in output exfiltrate data or phish when a user clicks or the client auto-loads them. |
How to defend
- Encode for the destination. HTML-escape before rendering, use a strict Content-Security-Policy, and never dangerouslySetInnerHTML raw model text.
- Parameterise every query. Bind model-derived values as parameters; never string-concatenate them into SQL, shell, or template code.
- Never execute model output. If the model must produce code or commands, run them in a sandbox with no secrets and no network by default, behind human review.
- Validate against a schema. Constrain outputs to expected types/enums and reject anything that doesn’t fit before acting on it.
- Allow-list URLs and paths. Fetch or open only what matches an explicit allow-list; block internal ranges.
- Assume the prompt is attacker-controlled. Combine this with prompt-injection defences — the two failures chain.
Go deeper
- The full 2026 risk map: OWASP LLM Top 10.
- How attackers steer the output: Prompt injection (LLM01).
- What command execution yields: the Reverse Shell sheet.
- Where this sits in an attack: the “exploitation” stage of the Cyber Kill Chain.
Aligned to OWASP LLM10:2026 Improper Output Handling — the OWASP GenAI LLM Top 10 2026 edition (released Aug 2026). A plain-language distillation of current practice. Something changed? Tell me.