Model output used in an action without validation
What it finds
Text produced by the model flows straight into code execution, a database query, or HTML rendering, with no schema validation or sanitization step visible.
Why it matters
Model output is untrusted input. If a prompt injection or hallucination shapes that text, it executes with the agent's full permissions.
What an attacker could do: Whatever the model can be tricked into writing — code, SQL, or script — would run as this agent.
How to fix it
Validate model output against a strict schema (zod, pydantic, JSON Schema) before acting on it, allowlist the actions it may request, and escape anything rendered as HTML.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- INSECURE_OUTPUT_HANDLING
- How it detects
- Looks for a risky pattern, and stays quiet when a matching safeguard is present.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Any text-based agent source or configuration (JS/TS/Python/JSON/YAML)
- OWASP LLM Top 10
- LLM02 - Insecure Output Handling, LLM09 - Overreliance
- NIST AI RMF
- MS-2.3, MS-2.5
- SOC 2
- CC7.1, CC6.1
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Command injection riskAV-RUNTIME-004 · Critical
- Unsafe dynamic code executionAV-RUNTIME-005 · Critical
- Privileged or host-mounted container configurationAV-RUNTIME-007 · Critical
- SQL query built from unescaped inputAV-RUNTIME-009 · Critical
- Unsafe deserialization of untrusted dataAV-RUNTIME-010 · Critical
- Prompt injection surface detectedAV-RUNTIME-002 · High