OWASP Top 10 for LLM 2026: All 10 Risks Explained
The OWASP Top 10 for LLM 2026 reshuffled AI risks, with excessive agency now at #3. See all 10 entries, what changed since 2025, and a practical checklist.
The OWASP Top 10 for LLM 2026 landed in August and reshuffled the biggest risks in AI applications. Prompt injection is still number one, but the real headline is at number three: excessive agency, the risk of an AI agent doing damage because it has too many tools, too many permissions, or too much autonomy. This guide walks through all ten entries in plain security-ops language, shows what changed since 2025, and ends with a checklist you can use to review an AI application this week.
Quick summary
- The OWASP Top 10 for LLM Applications 2026 was published in August 2026 by the OWASP GenAI Security Project.
- Prompt injection holds #1 and sensitive information disclosure holds #2. Excessive agency jumped from #6 to #3.
- Unbounded consumption climbed four spots, improper output handling fell to #10, and system prompt leakage became hidden context exposure.
- The list works best as a review checklist for every AI app, not as trivia to memorize.
What is the OWASP Top 10 for LLM?
OWASP is the open foundation behind the well-known Top 10 for web applications. Since 2023, it has maintained a separate list for applications built on large language models (LLMs), now under the OWASP GenAI Security Project. The goal mirrors the web list: give development and security teams a shared vocabulary for the most important risks and a starting point for fixing them.
According to the project’s official announcement, the 2026 edition passed 10,000 downloads in its first 48 hours.
How the 2026 ranking was built
The method changed this time. Per the Cloud Security Alliance research note, the team gathered 7,714 AI-related security incidents from public vulnerability databases and AI-harm repositories. Of those, 6,639 had enough detail to classify into the ten categories.
The community still drives most of the order: practitioner votes carry about 75% of the weight and incident evidence about 25%. That explains two surprises. Prompt injection shows up rarely in raw incident counts, yet it stays at #1. Misinformation, which voters ranked low, moved up because incidents show model outputs triggering real actions.
The 10 risks in the OWASP Top 10 for LLM 2026
Ten items in a row is a lot to hold in your head. So we group them into three questions every security person already asks: what goes into the model, what comes out of it, and what it can do.
| 2026 rank | Risk | Question |
|---|---|---|
| LLM01 | Prompt Injection | What goes in |
| LLM02 | Sensitive Information Disclosure | What comes out |
| LLM03 | Excessive Agency | What it can do |
| LLM04 | Supply Chain | What goes in |
| LLM05 | Data and Model Poisoning | What goes in |
| LLM06 | Unbounded Consumption | What it can do |
| LLM07 | Misinformation | What comes out |
| LLM08 | Hidden Context Exposure | What comes out |
| LLM09 | Vector and Embedding Weaknesses | What goes in |
| LLM10 | Improper Output Handling | What comes out |
What goes in: LLM01, LLM04, LLM05, and LLM09
LLM01 – Prompt injection. Models can’t reliably tell data from instructions, so malicious text can change their behavior. In 2026, the entry covers attacks that arrive through images, audio, video, tool output, or persistent memory. The document is blunt: there is no reliable prevention mechanism today. Design as if injection will sometimes succeed, and limit what the model can reach.
LLM04 – Supply chain. The classic third-party package problem, now with models, datasets, adapters, and converters in the mix. The playbook will feel familiar to anyone who has done software supply chain work: inventory your AI components, verify provenance and hashes, and pin versions instead of pulling “latest.”
LLM05 – Data and model poisoning. Someone tampers with what the model learns from or looks up, during training, fine-tuning, or in the knowledge base, to plant a bias or a backdoor that only fires on the right trigger. Tracking data lineage and testing the model after every tuning cycle are the main answers.
LLM09 – Vector and embedding weaknesses. This is the heart of RAG. Picture a library where someone swaps the shelf labels: the books are fine, but the path to them has been hijacked. Enforcing access control inside the retrieval query, not after it, keeps one user from getting another user’s documents.
What comes out: LLM02, LLM07, LLM08, and LLM10
LLM02 – Sensitive information disclosure. Still #2. Leaks don’t only happen in the answer: tool arguments, logs, and embeddings can carry sensitive data too.
LLM08 – Hidden context exposure. A new name with a wider scope than the old system prompt leakage entry. The LLM08 document covers system instructions, business rules retrieved through RAG, and tool definitions. The guidance: keep secrets out of that context, don’t rely on it for control, and enforce authorization outside the model.
LLM07 – Misinformation. A wrong answer that sounds right, used to make a decision or to trigger an action. The defense is to ground answers in current sources and check before acting.
LLM10 – Improper output handling. Generated text that flows straight into a browser, database, or shell without validation becomes XSS, SQL injection, or code execution. It fell to #10 because other categories grew faster, not because it got safer. The LLM10 guidance is to treat the model like any other user: validate, encode output for its destination, and use parameterized queries.
What it can do: LLM03 and LLM06
LLM03 – Excessive agency. The biggest climber, from #6 to #3. OWASP describes it as a system that enables damaging actions in response to unexpected, ambiguous, or manipulated outputs. Notice what’s missing: it doesn’t matter whether the root cause was injection or hallucination. If the agent can do it, eventually it will.
A recent example: on October 5, 2026, the Wikimedia Foundation reported unauthorized edits it attributes to AI agents operated by OpenAI, according to BleepingComputer. Most were test edits in sandbox areas, but there were also attempts to change the configuration of a citation tool.
The LLM03 mitigations read like onboarding rules for a new hire: fewer tools, single-purpose tools, minimal permissions, execution in the user’s context, human approval for high-impact actions, monitoring, and rate limiting.
LLM06 – Unbounded consumption. Up four spots. In the same Wikimedia case, the foundation points to millions of automated API requests. Runaway cloud bills, services knocked offline, and model cloning through mass querying all live here. The fix is hard spending and request caps per user and per agent, plus a circuit breaker for agents stuck in a loop.
Steve Wilson, the project’s founder, summed up the shift in the official announcement: AI is moving from models that generate content to agents that can act autonomously.
What changed from the OWASP Top 10 for LLM 2025 to 2026
| Risk | 2025 | 2026 | Change |
|---|---|---|---|
| Excessive Agency | #6 | #3 | Up 3 |
| Unbounded Consumption | #10 | #6 | Up 4 |
| Misinformation | #9 | #7 | Up 2 |
| Supply Chain | #3 | #4 | Down 1 |
| Data and Model Poisoning | #4 | #5 | Down 1 |
| Vector and Embedding Weaknesses | #8 | #9 | Down 1 |
| Improper Output Handling | #5 | #10 | Down 5 |
| System Prompt Leakage → Hidden Context Exposure | #7 | #8 | Renamed and broadened |
Prompt injection (#1) and sensitive information disclosure (#2) held their spots.
Checklist: putting the OWASP Top 10 for LLM to work
- Review one application at a time. Run the ten items as a checklist and mark each one: applies, doesn’t apply, or don’t know. The “don’t know” column is your backlog.
- Build the inventory. Which model, where it came from, which version, and what data feeds the RAG.
- Pull secrets and authorization logic out of system prompts. Assume everything in there will be discovered.
- Apply the Rule of Two to your agents. Proposed by Meta and cited by OWASP in LLM01: in a single session, an agent should have at most two of these three capabilities: reading untrusted content, accessing sensitive data, and changing state or communicating externally. Need all three? Put a human in the loop.
- Cap consumption. Spending and request limits per user and per agent, with an alert to your SOC.
This is episode five of the Fundamentals series. New here? Start with the welcome post and see what the channel is about on the About page.
FAQ
What is the OWASP Top 10 for LLM?
It’s an open list maintained by the OWASP GenAI Security Project that ranks the ten most critical security risks in applications built on large language models. Each entry includes examples, attack scenarios, and mitigations.
What is the number one risk in the OWASP Top 10 for LLM 2026?
Prompt injection is still number one, as it was in 2025. The document itself says there is no reliable prevention today and recommends limiting the impact when an injection succeeds.
What changed between the OWASP LLM Top 10 2025 and 2026?
Excessive agency rose from #6 to #3, unbounded consumption from #10 to #6, improper output handling fell from #5 to #10, and system prompt leakage became hidden context exposure with a broader scope.
Does the OWASP Top 10 for LLM cover AI agents?
It’s a solid foundation, especially LLM03 and LLM06. For agent-specific risks, OWASP maintains a separate list, the Top 10 for Agentic Applications.