The OWASP LLM Top 10 is the OWASP GenAI Security Project’s ranked list of the ten most critical security risks in applications built on large language models. Its 2026 edition, published August 4, 2026, is the first one checked against a record of real incidents. Eight entries moved, one was renamed, and Excessive Agency jumped from sixth to third. If you ship anything that puts a model in front of users, tools or internal data, this is the list your next threat model and test plan should follow.
The most useful sentence in the release is not in any of the ten entries. It sits in the project leads’ preface: “Stop trying to build a model that cannot be fooled. Build the system around it, so that when the model is fooled, and it will be, nothing important breaks.” We agree with every word of that, and we read the whole 2026 list through it below.
The OWASP LLM Top 10 2026 list, next to 2025
Get the order from the source. At least one widely shared news write-up published a table that does not match OWASP’s final 2026 source files. If your slide deck was built from coverage rather than the release, check it against this table, which pairs each 2026 rank with the 2025 list.
| Rank | 2026 entry | 2025 rank |
|---|---|---|
| LLM01 | Prompt Injection | 1 |
| LLM02 | Sensitive Information Disclosure | 2 |
| LLM03 | Excessive Agency | 6 |
| LLM04 | Supply Chain | 3 |
| LLM05 | Data and Model Poisoning | 4 |
| LLM06 | Unbounded Consumption | 10 |
| LLM07 | Misinformation | 9 |
| LLM08 | Hidden Context Exposure (was System Prompt Leakage) | 7 |
| LLM09 | Vector and Embedding Weaknesses | 8 |
| LLM10 | Improper Output Handling | 5 |
Several entries also grew in scope. Prompt injection now covers cross-modal attacks hidden in images or audio. Supply chain covers a promoted model artifact that is not what it claims to be, poisoning absorbs fine-tuning subversion, and output handling now spans the insecure code that assistants generate at scale.
Why the ranking moved: votes against incidents
Every earlier edition was a practitioner vote. For 2026 the team pulled a corpus of real incidents from public vulnerability databases and an AI-harm database, then built classifiers to sort the ones with enough detail. The vote still carries three-quarters of the weight and the incident data a quarter, which the leads describe as enough to move an entry a tier when belief and evidence diverge, and no more.
| Period | Value |
|---|---|
| Incidents collected | 7,714 |
| Incidents classified | 6,639 |
The two signals disagreed in instructive places. Ranked by raw incident count, prompt injection falls out of the top ten entirely. OWASP keeps it first anyway because it reads that gap as a defense effect, since teams fight injection hard and fewer clean exploits reach a public database. Misinformation runs the other way. Voters put it near the bottom while the incident record put it near the top, and the quarter weight lifted it from ninth to seventh. Excessive Agency is the move where both signals agree, because agentic deployments are where the damage is landing.
LLM security is an architecture problem, not a model problem
That new order points at the thesis we opened with. The 2026 prompt injection entry states plainly that no reliable prevention mechanism exists today, and the UK NCSC makes the same point, noting that current models do not enforce a security boundary between instructions and data inside a prompt. The research backs it up. Nasr and colleagues bypassed 12 recent defenses with attack success above 90% for most, when the majority had originally reported near-zero success against static tests.
EchoLeak shows what that looks like in production. A single crafted email steered Microsoft 365 Copilot into exfiltrating data with no click, chaining a classifier evasion, a link-redaction bypass with reference-style Markdown, auto-fetched images and a proxy the content security policy allowed. Four separate bypasses had to line up. The boring part of the architecture would have broken the chain, an output renderer that never fetched attacker-chosen URLs.
So the question for every entry below is the same. When the model is fooled, which control outside the model stops the damage, and who owns it?
Mitigation: how to defend each OWASP LLM Top 10 risk
These are the controls from each 2026 entry that keep working after the model has been manipulated. For prompt injection specifically, our earlier guide to prompt injection attacks and defense goes deeper on attack paths and testing.
LLM01 Prompt Injection
Hold credentials and every state-changing capability in application code, and route privileged calls through a deterministic policy engine that re-validates intent and arguments at execution time. Strip invisible tag-block and zero-width Unicode at every ingest and render boundary. Then budget capabilities with Meta’s Rule of Two, which treats any agent that combines untrusted input, sensitive data and state change or external communication as needing per-action human approval.
LLM02 Sensitive Information Disclosure
The single control we would put first is to authorize before retrieval, inside the index query, not at the application layer after the chunks come back. OWASP also flags leaks through logs and traces, so scrub them before they reach your observability stack, and send external providers only the fields a task needs.
LLM03 Excessive Agency
OWASP names three root causes, excessive functionality, permissions and autonomy. Replace open-ended tools (run a shell command, fetch any URL) with narrow ones, execute every tool in the calling user’s context rather than a service identity, and enforce authorization in code. Complete mediation means the model never decides whether an action is allowed.
LLM04 Supply Chain
Models, adapters and datasets belong in the same inventory as code. The entry points to AI bills of materials, model signing backed by a transparency log, and treating conversion and merge services as high-risk promotion points. For agent tool registries and MCP servers, our MCP security guide covers pinning and tool poisoning.
LLM05 Data and Model Poisoning
Poisoning is expensive because the fix is not a patch. OWASP notes it can require data revalidation, retraining, model replacement or pipeline redesign, so provenance tracking on every dataset and fine-tune input is cheaper than finding out later.
LLM06 Unbounded Consumption
The defining feature is cost asymmetry, and the entry now covers Denial of Wallet and short, benign-looking prompts that drive reasoning models into long thinking loops. Rate-limit on tokens per minute and per day, not requests, estimate tokens before inference, and set hard spending caps that halt work rather than send an alert after the bill has run.
LLM07 Misinformation
The risk is not that the model is wrong but that wrong output is trusted and acted upon. OWASP’s claim-check-act pattern separates generation from execution. One of its scenarios should worry anyone running AI in a SOC, a security agent that misclassifies normal traffic and blocks a production segment on its own.
LLM08 Hidden Context Exposure
The renamed entry covers system prompts, developer instructions, retrieved policy text and tool schemas. OWASP’s advice is to assume all of it is discoverable, so never place credentials there and never rely on a hidden rule for authorization.
LLM09 Vector and Embedding Weaknesses
OWASP’s summary is worth repeating in design reviews: poisoning makes the system wrong, inversion makes it leak, jamming makes it silent. In multi-tenant retrieval the common failure is a similarity search across the full index with access control applied afterwards, so segregate by tenant and trust tier.
LLM10 Improper Output Handling
Its fall to tenth does not mean the flaw is solved. Treat the model as any other untrusted user, use parameterized queries and context-aware encoding, strip ANSI escape sequences before output reaches terminals or logs, and disable auto-rendering of Markdown images and link previews. That last control would have closed EchoLeak’s exfiltration path.
OWASP LLM Top 10 vs the Agentic Top 10
The 2026 edition draws its own boundary. It covers the model as a component inside an application. The moment the model becomes an actor, with tools it can call, memory it carries between sessions and consequences downstream, the leads route the risk to the OWASP Top 10 for Agentic Applications. Excessive Agency is where the two meet, and the entry maps itself to the agentic list’s tool misuse, privilege abuse and cascading failure items. Our position is simple. If any model in your estate can take an action, test it against both lists, because neither covers that ground alone. That is the scope we work to in LLM and agent security engagements.
Frequently asked questions
What is the OWASP Top 10 for LLM applications?
It is a community-maintained ranking of the most critical security risks in applications built on large language models, published by the OWASP GenAI Security Project. Each entry describes the risk, common examples, attack scenarios and mitigations. The 2026 edition is the current release, published August 4, 2026, and its Appendix A maps every entry to MITRE ATLAS, NIST and CWE.
What changed in the OWASP LLM Top 10 2026?
Excessive Agency rose from sixth to third, Unbounded Consumption from tenth to sixth and Misinformation from ninth to seventh. Improper Output Handling fell from fifth to tenth, and System Prompt Leakage became Hidden Context Exposure with a broader scope. The method changed too, with incident data now carrying a quarter of the weight.
Is prompt injection still number one?
Yes. It stays at LLM01 even though it falls out of the top ten when ranked by raw public incident counts. OWASP attributes that gap to teams defending hard against injection, so fewer clean exploits reach public databases, while the exposure remains anywhere a model reads untrusted input.
How do you use the OWASP LLM Top 10 for LLM security testing?
Map every point where untrusted input reaches a model and where model output reaches another system, then test each entry at those points. OWASP recommends red-teaming with the defense specification disclosed, because static attack sets overstate how well filters hold. Our AI red teaming guide covers how to scope that work.
Bottom line
Rebuild your LLM threat model on the 2026 order, starting with Excessive Agency if any model in your stack can call a tool. For each entry, name the control outside the model that stops the damage and the team that owns it. Then plan for the day the model is fooled, because OWASP now says plainly that it will be.