Model output is untrusted input
OWASP's Improper Output Handling covers what happens downstream: insufficient validation of model output before it is passed to another component. Whatever the model returns should be treated exactly as you would treat a string typed by a stranger.
Why it is like this
The model is a text generator influenced by its input, some of which may be hostile. Anything it emits inherits that taint, so the usual rules apply at the boundary where the text stops being text and starts being an action.
Not to be confused with
An output-quality concern. It is an injection vector: model output rendered as HTML, run as a shell command, interpolated into SQL or passed to an interpreter is the same class of bug as any other unvalidated input, with a more creative source.
In practice
Escape it, validate it against a schema, and give the thing that consumes it the least privilege that works — the same things you would do with a form field.
Source: OWASP Top 10 for Large Language Model Applications, 2025 — LLM05:2025 Improper Output Handling. Read on .
The OWASP Top 10 for LLM Applications is © the OWASP Foundation and published under a Creative Commons licence; NIST AI 600-1 is a US Government work in the public domain. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation or NIST.
Odd one out Check yourself
Three of these are Improper Output Handling. Which is a different problem?
Show the answer
Model output that is fluent but factually wrong
That is confabulation — a content problem. Improper Output Handling is about what the next component does with the string.