I believe you need to be slightly more clear with regards to what youre calling an error.
Exceptions (timed out, database error, etc.) should be handled using specific exception handlers (not least because you often don't want to show the error message to the end user).
In this scenario, look at overloading the OnException()
method on the controller. (or having all your controllers inherit from a common ControllerBase which has that method overriden to avoid repetition)
You may also want to check the value of filterContext.HttpContext.IsCustomErrorEnabled
when handling exceptions to determine whether to expose detailed exception information or to obfuscate it.
Remember that exceptions should be for exceptional circumstances - "normal" operation should never result in an exception
The other type of error you're mentioning is more like "Unable to process request due to business rules / invalid input" (or similar) in which case, adding error messages to the ViewModel seems appropriate. They may not be direct validation errors but they are most likely as a result of the user input