AI Security Atlas › All entries › LLM Application & Output Security
Output Encoding & Strict CSP
Model output is sanitized and rendered under a Content-Security-Policy that forbids remote resource loads.
Open in the interactive atlas →Impact
Neutralizes markdown-image and HTML exfiltration channels regardless of injection success.
Why this severity
Guardrails take the highest severity of the risks they mitigate: Unsanitized Output Rendering (High), Output-Rendered Data Exfiltration (High).
Method: OWASP Risk Rating Methodology
Related
Mitigates
- Unsanitized Output Rendering Vulnerability · High severity
- Output-Rendered Data Exfiltration Threat · High severity
Remediation
- Sanitize output server-side and again at render.
- Set img-src and connect-src to self plus a vetted allowlist.
- Show link destinations before navigation.
How to verify
- CSP headers present on every chat route.
- Exfil fixtures produce CSP reports, not network hits.
Pattern
Content-Security-Policy: default-src 'self'; img-src 'self' data:; connect-src 'self'Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM05:2025 Improper Output Handling
MITRE ATLAS
- AML.M0020 Generative AI Guardrails
NIST AI RMF 1.0
- MEASURE 2.7 AI system security and resilience are evaluated and documented