Agent WranglersAI agents and models Required
Treat model output as untrusted
Handle every model answer like text from a stranger. Escape it before showing it, and never run it as code, SQL or a shell command.
How to do it
Render answers as text or through a Markdown renderer that strips HTML and scripts. Block images and links to unknown sites, because they can carry data out in the address. If the model must build a query, give it a tool with fixed parameters instead.
How to check
Ask the model to repeat <img src=x onerror=alert('AW-TEST-5e6f')> and a Markdown image pointing to test.example.org. The page shows plain text and loads nothing from outside.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/untrusted-model-output.