Model output reaches a code, query, shell, markup, or file-path interpreter without validation or encoding

Treat model output as untrusted input: validate it against a schema, encode or parameterize it for its sink, and run generated code only in a sandbox.

At every point where model or agent output leaves the model call, the code that consumes it applies the control its sink needs. Structured output is parsed with a strict schema (pydantic model_validate_json, zod .parse, or the provider's strict structured-output mode) and rejected, not repaired by another model call, when it does not fit. Chat UIs render Markdown with raw HTML disabled (react-markdown without rehype-raw, or marked output passed through DOMPurify.sanitize) and do not auto-load remote images or link previews from model text (disallowedElements={['img']}, a urlTransform allowlist, or a Content-Security-Policy img-src limited to the app's own origins). Database tools take model values only as bound parameters, shell tools take an argument list with shell=False and an allowlisted executable, file tools resolve paths inside a fixed base directory, and model-written code runs in an isolated sandbox (container or microVM with no credentials and no network by default) instead of eval or exec in the application process. Control characters such as ANSI escape sequences are stripped before output is written to terminals or log viewers.

Where it goes: 9 AI output handling, 1 application source code, 15 agent action surface, 6 API calls and integrations.

What reviewers look for: no dangerouslySetInnerHTML, innerHTML, v-html, or rehype-raw fed by model text without a sanitizer; no eval, exec, new Function, os.system, or shell=True reached by model output; SQL built from model values only through placeholders or an ORM; a schema parse between the model call and any tool or database write; image rendering of model Markdown disabled or allowlisted; code execution delegated to a sandbox service or container.

{messages.map(m => (
  <div key={m.id}
    dangerouslySetInnerHTML={{ __html: marked.parse(m.content) }} />
))}

import ReactMarkdown from 'react-markdown';   // escapes raw HTML by default; no rehype-raw
{messages.map(m => (
  <ReactMarkdown key={m.id} disallowedElements={['img']} unwrapDisallowed>
    {m.content}
  </ReactMarkdown>   // no auto-loaded images: model text cannot beacon data out
))}

Engineering guidance, not legal advice. Each provision below may add its own details (a cadence, a deadline, a required notice element): open it for those.