Implementation guide
OWASP AISVS v1.01
Model Behavior, Output Control & Safety Assurance · Output Safety
Outputs can't trigger outbound requests
Verify that model-generated output is prevented from triggering outbound requests.
OWASP AISVS v1.01, requirement 7.3.3
In plain English
Model output must not be able to make your system or the user's browser send requests elsewhere. The classic attack is an injected instruction that makes the model write an image link with stolen data in the address. When the chat window loads the image, the data goes to the attacker.
What good looks like
- Images and links in model output are not fetched automatically from arbitrary domains.
- Rendered output can load resources only from an approved list of domains.
- Server-side code never fetches a URL just because it appeared in model output.
- Tools that fetch URLs go through an allow-list and a proxy.
How teams usually do it
- A Content Security Policy on the chat interface that restricts img-src and connect-src to your own domains.
- Stripping or neutralising Markdown images and auto-links in output, or rewriting links to go through a click-through warning page.
- Switching off link previews ("unfurling") for model-generated messages in chat integrations.
Suggested evidence
- Rendering configuration and the CSP header.
- A test using an exfiltration-style image link, showing no request leaves.
- Egress rules for server-side components.
Common mistakes
- Rendering Markdown images from model output unrestricted.
- Fixing the web interface and forgetting the mobile app, email notifications or chat integration that render the same output.
- Allow-listing a domain that hosts open redirects or user-uploaded content.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.