What is Unsafe Output Handling?
Unsafe output handling, told as a story about a finished dish being fed straight into an automatic machine, unchecked — and the accident that follows.
The machine moves exactly as the dish says, right away.With no check in between, the dish becomes the next machine's command, exactly as written.
Neither the chef nor the machine doubts the other.You can't tell a dangerous dish from a safe one just by looking — only by reading the words.
Feeding the dish straight into the machine — and it breaks.A concrete accident that happens when the dish — the model's output — is fed straight into another system, unchecked.
One path runs the words exactly, right away. The other looks once more first.The safe path checks the dish once more, and only lets the expected shape through to the machine.
Into code, into records, onto a screen — it breaks the same way each time.A taster — a guardrail — is the fence you always keep up. This is the concrete accident that happens when the dish runs like a tool call, with no taster at all.
Unsafe output handling = feeding the chef's dish straight into an automatic machine, unchecked — and the machine obeys whatever dangerous words were written on it.
A vulnerability where an LLM's output (code, SQL, shell commands, HTML, …) is passed to another system — an interpreter, a database, a shell, a browser — and executed without validation, escaping, or sandboxing. The result looks like classic injection: remote code execution, SQL/command injection, XSS. A guardrail is the general device that filters input and output; this is the concrete accident that happens when that device is missing.
When grown-ups say it
- Unsafe Output Handling
- Feeding the dish straight into the machine. The machine obeys whatever is written on the dish, exactly.
- Guardrail
- The tasting checkpoint. The general device in the AI world — this page is the accident when it is missing. → What is a Guardrail?
- Tool Calling
- The part where the machine just acts. The problem is output running immediately, like a tool call. → What is Tool Calling?
- Code Generation
- A recipe note the chef writes out directly. Running generated code as-is is the most common version of this accident. → What is Code Generation?
- Injection
- Planting text into a machine as a command. The general concept in the security world — the shape is identical. → What is Injection?
- Least Privilege
- Even the machine gets only what it needs. The smaller the machine's power, the smaller the accident.
- Sandbox
- A box that keeps an accident from spreading to the whole kitchen. Running things inside isolation is always the safer choice.
- Output Validation
- One more look, right before the machine. Only the expected shape passes through — everything else is sent back.