OWASP Top 10 for LLM Applications, 2025
LLM05: Improper Output Handling
Improper output handling means the application does not validate, sanitize or safely handle what a model produces before it reaches other components. Because prompts can shape the output, a user can end up with indirect access to functionality the application never meant to expose.
Improper Output Handling in more detail
OWASP lists the possible results as cross-site scripting, cross-site request forgery, server-side request forgery, privilege escalation and remote code execution. The risk grows when the model has excess privileges, when indirect prompt injection is possible, when third-party extensions do not validate inputs, when output encoding is missing, or when monitoring and rate limiting are absent. The safe default is to treat model output like any other untrusted user input. Output validation in guardrails and structured output checks are the tool features most relevant here.
The risk and its name come from OWASP; the summary, examples and controls on this page are our plain-English reading of OWASP's page. Source: Source, checked October 21, 2026: genai.owasp.org (opens in a new tab)
How it shows up
- Model output is passed straight into a shell or into functions such as exec or eval.
- Generated JavaScript or Markdown is rendered in a browser and runs as cross-site scripting.
- Model-written SQL runs without parameterization.
- Model output is used to build file paths without sanitization, which allows path traversal.
- Generated content goes into an email template without escaping.
Controls that reduce it
- Treat model output as untrusted input and validate it before any backend use.
- Follow OWASP ASVS guidance for validation, sanitization and output encoding.
- Encode output for its destination, such as HTML encoding for web pages and escaping for SQL.
- Use parameterized queries or prepared statements for any database operation that involves model output.
- Set a strict content security policy to limit scripts from generated content.
- Log and monitor outputs to spot unusual patterns.
Controls reduce risk, they do not remove it
No single control covers improper output handling on its own. Combine controls, and treat any tool as one layer.
Categories that address it
Our analysisThese are the directory categories whose tools we score on this risk. The mapping is our analysis.
Layers that address this risk
Our AI security layers are an editorial model, not a standard. Source states means OWASP's own text for LLM05 names the control the layer delivers. Our analysis means we drew the link.
- L4 Testing and red teaming Our analysis
- L6 Runtime guardrails Source states
- L7 Agent and tool access Our analysis
- L8 Monitoring and response Source states
Tools mapped to LLM05
Our analysis9 tools are mapped. Each tool is mapped only where a documented capability supports it. Open a tool page to see the capability and its source. Coverage Score compares tools within one category.
| Tool | Type | Deployment | Pricing model | OWASP risks | Coverage Score | Last reviewed |
|---|---|---|---|---|---|---|
| NeMo GuardrailsNVIDIA · Guardrails | Open sourceApache-2.0 |
| Free |
| 76 out of 100 | |
| PortkeyPalo Alto Networks (Portkey) · Guardrails Now Prisma AIRS AI Gateway | Open sourceMIT |
| Freemium |
| 69 out of 100 | |
| Bedrock GuardrailsAmazon Web Services · Guardrails | Commercial |
| Usage-based |
| 60 out of 100 | |
| Llama ProtectionsMeta · Guardrails | Open, custom license |
| Free |
| 56 out of 100 | |
| Guardrails AIGuardrails AI · Guardrails | Open sourceApache-2.0 |
| Free |
| 52 out of 100 | |
| Cisco AI DefenseCisco · Guardrails | Commercial |
| Not published |
| 47 out of 100 | |
| AliceAlice · Guardrails | Commercial |
| Not published |
| 42 out of 100 | |
| Radware LLM FirewallRadware · Guardrails | Commercial |
| Not published |
| 41 out of 100 | |
| LLM GuardPalo Alto Networks (Protect AI) · Guardrails Archived | Open sourceMIT |
| Free |
| 66 out of 100 |
No tools match these filters. Clear a filter to see more.
Why each tool is mapped
- NeMo Guardrails: Output rails check model responses before they reach the user.
- Portkey: Deterministic output checks such as JSON schema and regex run on model responses.
- Bedrock Guardrails: Automated Reasoning checks validate model responses against logical rules.
- Llama Protections: CodeShield filters insecure code in model output before it is used.
- Guardrails AI: Output guards check model responses against validators before the application uses them.
- Cisco AI Defense: Outputs are scanned for sensitive or harmful content before they reach users.
- Alice: Every response is screened and blocked before it reaches users or systems.
- Radware LLM Firewall: Validates model responses against guardrails before they are used.
- LLM Guard: Output scanners check JSON structure and URLs in model responses.