AI › Module 6 › Lesson 3
Output Handling
Output handling literacy — encoding, sandbox, no raw HTML/JS exec, structured output validation — on `$AI_LAB` app responses.
Visual · t32_output_handling
Output handling = named LLM02 defense rows. $AI_LAB. Original Cyberlium.
Opening
LLM output can carry XSS, SQL, or shell — name output handling controls on YOUR lab app before rendering model text in prod UI.
Output handling literacy names: treat model output as untrusted category, encode for UI context (HTML/JSON/markdown), structured output schema validation, sandbox code execution category, no direct eval of model-generated code, and logging/redaction of sensitive fields. Analyst audits `$AI_LAB` toy app response path — documents three output-handling gaps and fixes (encode, schema validate, sandbox boundary) — without shipping model HTML unsanitized, without running generated shell on host, without paste of prod user PII in test prompts. Cyberlium teaches LLM02 defender rows — NOT how to chain XSS through stranger apps. Refused: XSS PoC against unauthorized sites, auto-exec generated code, prod paste without RoE. Lab row: output handling audit table three findings with fix category.
1. Named output risks
XSS in rendered markdown, SQL in generated queries, shell in code blocks — three literacy anchors.
Model text is untrusted until validated — document encode path on lab UI.
Command guide
Try these commands — Named output risks
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: OWASP LLM02 Insecure Output Handling (https://owasp.org/www-project-top-10-for-large-language-model-applications/); OpenAI safety (https://platform.openai.com/docs/guides/safety-best-practices); CISA AI (https://www.cisa.gov/ai). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defense rows
Context-aware encoding, JSON schema validation, execution sandbox, deny eval — four controls.
Link LLM02 to Module 6-1 Top 10 mapping row.
3. Refused
No XSS PoC on stranger sites; no auto-exec generated code on host.
Output handling supports secure apps — not offensive chaining.
4. What you ship: output handling audit table
Three findings + fix category each + NEVER auto-exec model code line.
5. What you record before the next lesson
Output handling audit table path.
6. Wrong vs right: stranger SaaS vs YOUR toy LLM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Render model HTML unsanitized in lab then pivot XSS PoC to stranger site.
Right
Output handling audit from `$AI_LAB` app path. Next: LLM App Lab.
Mission: output handling audit table
1) Name three output risk categories. 2) Three audit findings on lab app. 3) Fix category per row UTC. 4) Write NEVER auto-exec model code line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Structured output schema — literacy stub?”
Knowledge Check
APPLY: Output handling literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Model output is trusted by default.
True or False
Knowledge Check
APPLY: LLM02 defense includes:
Multiple choice