Agent WranglersAPS-86Recommended
Treat model output as untrusted
Handle every model answer like text from a stranger. Escape it before showing it, and never run it as code, SQL or a shell command.
How to do it
Render answers as text or through a Markdown renderer that strips HTML and scripts. Block images and links to unknown sites, because they can carry data out in the address. If the model must build a query, give it a tool with fixed parameters instead.
How to check
Ask the model to repeat <img src=x onerror=alert('PENTEST-5e6f')> and a Markdown image pointing to test.example.org. The page shows plain text and loads nothing from outside.
Sources
Related rules
- AIF-34 Check output before anyone sees it in AI features
- APP-66 Build generated screens only from your own components in Web app interface
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/ai-features-and-agents/untrusted-model-output">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.