The Breach Is Downstream of the Prompt
Run the lab below and you get a result most teams do not expect.
Twenty-four shapes of model output. Seventeen of them are answers your code must not act on.
Most carry a quote, a semicolon or a dot-dot-slash. A few are simply the wrong type, or null, or
not JSON at all. A handler that pulls the first {...} out with a regular expression lets 15 of those
17 through. Now replace it with a stricter handler. This one insists the whole answer parses as JSON and
carries the right fields. It still lets 15 of 17 through, and it throws away 3 of the 7 good
answers the regex had been handling fine.
So the upgrade stopped nothing it had not already stopped, and it started rejecting good answers. No better on the first count. Worse on the second.
That result is not a quirk of the test set. It falls out of a confusion that sits in most codebases that call a language model. "Did the output arrive in the right shape" gets treated as if it answered "is the value in it safe to use". Those are separate questions. Almost every dangerous payload here has a perfectly good shape.
The whole security conversation around language models has been about the way in: the prompt, the injected instruction, the poisoned document. That work matters and the earlier lessons in this chapter cover it. But an injected instruction on its own does nothing. It has to be carried somewhere that acts on it. The carrier is your own code, taking the model's answer and putting it into a query, a command, a file path, a template, or another agent's input.
OWASP calls this Improper Output Handling, and lists it as LLM05:2025. If you learned it as "insecure output handling" that was its name in the 2023 list, where it sat at LLM02. Same risk, new label.
So this is not a variation on . Prompt injection is how an attacker gets a sentence into the model. Insecure output handling is how that sentence turns into a dropped table. You can have the second without the first, too. A model that simply gets the answer wrong, with no attacker anywhere, will still hand you a value your code was not ready for.