Programs that integrate LLM APIs routinely send sensitive data to external services and execute LLM-generated strings as database queries, shell commands, or API calls. No existing type system or static analysis captures the security properties of these interactions. We present LLMEffect, a type-and-effect system for LLM-integrated programs. LLMEffect assigns security labels to data flowing into LLM calls, enforces a typestate discipline on LLM output before it can reach dangerous operations, and provides a dual-bound iteration model that distinguishes productive agent steps from error-recovery loops. We describe the design of LLMEffect and outline a Python-based implementation with an accompanying static analyzer.