Issue Details
Improper Output Handling
llm05-2025 • Rank #5 in OWASP 2025
Explanation
Improper output handling emerges when generated content is consumed by downstream systems without safety checks, enabling indirect injection and policy bypass. Outputs can contain malicious instructions, unsafe code, or deceptive narratives that trigger harmful automation. The weakness is the absent validation boundary around generated data.
Remedy
Apply strict output contracts, contextual sanitization, and policy enforcement before output is rendered or executed. For tool and workflow actions, validate intent and parameters with deterministic guardrails. Introduce approval controls for high-impact operations and maintain audit logs for output-driven actions.
| Year | Rank | Category |
|---|---|---|
| 2025 | #5 | llm05-2025 - Improper Output Handling |