Output Sanitization

Sanitization must be context-aware, applying different rules based on the output's destination. A code snippet destined for a sandboxed execution environment requires different treatment than text rendered in a browser.

• HTML Context: Escape <, >, &, and quotes to prevent cross-site scripting (XSS).
• SQL Context: Escape single quotes and enforce parameterized queries.
• Shell Context: Strip or escape backticks, $(), and semicolons.
• Markdown Context: Neutralize raw HTML and dangerous link schemes like javascript:.

Automated detection and masking of personally identifiable information (PII) is a core sanitization function. This goes beyond simple regex to include named entity recognition (NER) models that identify names, addresses, and financial data.

• Entity Types: Names, emails, phone numbers, SSNs, credit card numbers, API keys.
• Masking Strategies: Replace with entity type labels (e.g., [NAME]), synthetic data, or irreversible hashes.
• Compliance: Essential for meeting GDPR, HIPAA, and PCI-DSS requirements for data minimization.

A critical defense against remote code execution (RCE). The sanitizer must parse the output and remove or neutralize any content that could be interpreted as executable instructions by a downstream compiler, interpreter, or shell.

• Static Analysis: Identify dangerous functions (eval, exec, os.system) and import statements.
• Language-Specific Rules: Apply distinct parsers for Python, JavaScript, SQL, and shell scripts.
• Sandboxing Integration: Even after stripping, code should only run in an isolated, ephemeral environment as a secondary control.

Sanitization includes structural validation to ensure the output conforms to a strict, expected schema. This is a primary defense against prompt injection payloads that attempt to break out of a structured format like JSON.

• JSON Schema Validation: Reject any output that does not parse as valid JSON or violates the defined schema.
• Canonicalization: Convert data to a standard, unambiguous format before validation to prevent bypasses using Unicode normalization tricks.
• Type Enforcement: Ensure numeric fields contain numbers, boolean fields contain true/false, and string fields do not exceed maximum lengths.

For multi-modal agents, sanitization extends beyond text to include image, audio, and video outputs. This involves applying classifiers to detect and block prohibited content before it reaches the user.

• Image Safety: Use vision models to detect NSFW content, violence, or embedded text with PII.
• Audio Filtering: Detect generated speech that mimics real individuals or contains hate speech.
• Steganography Detection: Scan media for hidden data or payloads embedded using steganographic techniques.

Sanitization pipelines must enforce hard limits on output size to prevent denial-of-service (DoS) attacks and control costs. An agent tricked into generating a massive, repetitive output can exhaust memory and API quotas.

• Max Token Limit: Truncate or reject outputs exceeding a predefined token count.
• Repetition Penalty: Detect and collapse degenerate, looping text sequences.
• Compression: For allowed large outputs, apply lossless compression before storage or transmission.

The automated process of detecting and masking personally identifiable information from agent outputs before delivery. Modern redaction systems use named entity recognition (NER) models fine-tuned on domain-specific data to identify:

• Direct identifiers: Names, email addresses, social security numbers, phone numbers
• Quasi-identifiers: ZIP codes, birth dates, gender—which can be combined to re-identify individuals
• Contextual PII: Information that becomes identifying when combined with other fields

Unlike simple regex-based approaches, ML-driven redaction handles unstructured text, misspellings, and context-dependent identifiers. Common implementations include Microsoft Presidio and AWS Comprehend PII detection, which support custom entity types for industry-specific compliance requirements like HIPAA and GDPR.

A classifier-based mechanism that blocks or flags generated text, images, or other modalities based on predefined safety, toxicity, or policy violation criteria. Content filters operate at multiple levels:

• Pre-generation: Blocking prompts that request prohibited content
• Post-generation: Scanning outputs before delivery to users
• Streaming: Interrupting token streams mid-generation when toxicity thresholds are crossed

Production-grade filters like OpenAI's Moderation API and Perspective API use multi-label classifiers trained on human-annotated data covering categories including hate speech, harassment, sexually explicit content, violence, and self-harm. Effective filters balance precision (avoiding false positives that degrade user experience) against recall (catching true violations).

A security mechanism that runs an agent's generated code or tool calls inside an isolated, ephemeral environment to prevent access to the host system. Key isolation techniques include:

• Container-based: Docker containers with minimal base images, no network access, and read-only filesystems
• MicroVM-based: Firecracker or gVisor for hardware-level isolation with millisecond startup times
• Language-level: Restricted Python interpreters or JavaScript isolates using V8 sandboxing

Best practices mandate that sandboxes be single-use (destroyed after each execution), resource-limited (CPU/memory caps to prevent DoS), and network-isolated (no outbound connectivity unless explicitly whitelisted). Tools like E2B and CodeInterpreter SDK provide managed sandbox infrastructure specifically designed for AI agent code execution.

A resilience pattern that automatically halts an agent's operation or tool access when a predefined failure threshold or anomaly rate is exceeded. Borrowed from electrical engineering and popularized by Michael Nygard's 'Release It!', circuit breakers prevent cascading failures by:

• Closed state: Normal operation, monitoring error rates
• Open state: All requests immediately rejected when error threshold breached
• Half-open state: Limited trial requests allowed to test if the system has recovered

In agentic systems, circuit breakers monitor metrics like hallucination rate, policy violation count, tool call failure rate, and token consumption velocity. When thresholds are exceeded, the agent is either fully halted or restricted to safe, read-only operations until a human operator intervenes.