Treating AI Output as Untrusted Input