---
title: "Treat model output as untrusted · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/untrusted-model-output
updated: 2026-10-20
licence: "All rights reserved"
---

# Treat model output as untrusted

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [AI agents and models](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models)
- Rule: Handle every model answer like text from a stranger. Escape it before showing it, and never run it as code, SQL or a shell command.
- How: Render answers as text or through a Markdown renderer that strips HTML and scripts. Block images and links to unknown sites, because they can carry data out in the address. If the model must build a query, give it a tool with fixed parameters instead.
- Check: Ask the model to repeat `<img src=x onerror=alert('PENTEST-5e6f')>` and a Markdown image pointing to test.example.org. The page shows plain text and loads nothing from outside.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/untrusted-model-output`.

- Previous: [Ask a person before the agent spends or deletes](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/human-approval)
- Next: [Keep secrets out of the system prompt](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/no-secrets-in-prompt)
- [AI agents and models](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models)