Insecure output handling (LLM → sink)

When it applies

The app treats LLM output as trusted and passes it into a dangerous sink — rendered as HTML, executed as code/SQL/shell, or forwarded to another API. The model becomes an injection vector, especially when its input is attacker-influenced (→ chain with ai-prompt-injection).

Why it works

Developers trust their own model's output, but it's just text — and an attacker can steer it via prompt injection. If that text lands in innerHTML, eval, a SQL string, a shell command, or a system call without sanitization, you get XSS/RCE/SQLi through the LLM.