Insecure output handling

What Insecure output handling means

The output is untrusted even when it came from a trusted model endpoint.

Related terms in Security and privacy

Where an agent, a tool or a page can be turned against its operator, and the controls that limit the damage without proving safety.

X-Frame-Options · frame-ancestors · Referrer-Policy · Permissions-Policy · Encrypted Client Hello · lookalike domain · homoglyph · incident switch · high-risk field · Indirect prompt injection · Direct prompt injection · Jailbreak · Data exfiltration · Sensitive information disclosure · Secret leakage · Excessive agency · Least privilege · Trust boundary · Input validation · Output validation · Allowlist · Denylist · SSRF · RCE · Credential scope · OAuth scope · API key · Bearer token · mTLS · Rate-limit policy · Audit log · PII · Data minimization · Purpose limitation · Retention period · Data residency · Tenant isolation · Threat model · DMARC · DMARC alignment · SPF · DKIM · MTA-STS · TLS-RPT · CAA record · DNSSEC · hard bounce

Questions about Insecure output handling

What is Insecure output handling?

Passing model-generated content into interpreters, browsers, databases, or shells without appropriate validation.

What does Insecure output handling not show or guarantee?

Passing model-generated content into interpreters, browsers, databases, or shells without appropriate validation.

Which area of the glossary does Insecure output handling belong to?

Security and privacy: Where an agent, a tool or a page can be turned against its operator, and the controls that limit the damage without proving safety.

← Secret leakage  ·  Excessive agency →

See it in the full glossary · 772 terms across 19 areas.