Structured-output smuggling in JSON mode

Developers assume JSON mode is safe because it constrains shape, not content. If a field flows into a query, a shell command, or an authorization decision, injected content still lands in the sink.

{"action":"lookup","target":"users; DROP TABLE sessions--","note":"benign"}

The value passes schema validation but poisons the consumer.

row = db.execute(f"SELECT * FROM users WHERE name='{out['target']}'")  # sink

Pro note: the model faithfully carries attacker text into a well-formed field, so schema validation gives false comfort. Audit every place a model-produced value is concatenated into SQL, shell, paths, or an allow/deny check, and treat those values as untrusted user input.