Short answer

The OWASP Top 10 for LLM applications is a community list of the most important security risks in applications built on large language models. The current edition is the 2026 list, published by the OWASP GenAI Security Project on August 4, 2026.

In order, the 2026 risks are prompt injection, sensitive information disclosure, excessive agency, supply chain, data and model poisoning, unbounded consumption, misinformation, hidden context exposure, vector and embedding weaknesses, and improper output handling.

The biggest changes from 2025: excessive agency jumped from sixth to third, unbounded consumption rose from tenth to sixth, improper output handling fell from fifth to tenth, and system prompt leakage became the broader hidden context exposure.

If you want the practical follow-up after this overview, read our guide to reducing prompt injection risk. If you want the basics first, read our prompt injection explainer. If you want the MCP-specific operational checklist, read our 2026 guide to MCP security best practices. This page is the framework view: what the full risk map looks like and how to use it.

What is the OWASP Top 10 for LLM applications?

OWASP's list is a prioritization framework for AI application security, maintained by the OWASP GenAI Security Project. It is not a law, not a certification, and not a complete security program. It is a shared map that helps builders, security teams, and operators ask better questions earlier.

The 2026 edition draws a clear boundary. The list covers the model as a component inside your application. Once the model becomes an actor, with tools it can call, memory it keeps between sessions, and actions it sets off downstream, OWASP points to its separate Top 10 for Agentic Applications and recommends reading the two lists together.

The best way to use the list is to pair it with concrete engineering work. NIST's Generative AI Profile is useful for risk-management language, and MITRE ATLAS is useful for attack-path thinking. OWASP gives the list. Your engineering process still has to turn that list into controls and tests.

The OWASP Top 10 for LLM applications 2026 in plain English

This table summarizes each 2026 entry. The descriptions paraphrase OWASP's own; the official document has the full detail, examples and mitigations.

OWASP item Plain-English meaning Why it matters
LLM01 Prompt Injection Input changes the model's behavior in ways the developer did not intend. It can arrive in user text, web pages, files, tool output, images or audio. Models cannot reliably separate instructions from data, so there is no complete fix. The 2026 entry adds cross-modal attacks hidden in images or audio.
LLM02 Sensitive Information Disclosure Private, confidential or regulated data leaks through answers, tool-call arguments, logs, reasoning traces or embeddings. It turns AI convenience into a data-exposure incident.
LLM03 Excessive Agency A model with tools takes a damaging action after unexpected, ambiguous or manipulated output. Too much functionality, permission or autonomy turns a small model error into real damage.
LLM04 Supply Chain Risk enters through third-party models, datasets, adapters, conversion pipelines and platforms. Teams rely on components they did not build. The 2026 entry adds model artifacts that are not what they claim to be.
LLM05 Data and Model Poisoning Training, fine-tuning, embedding or retrieval data is tampered with to plant backdoors or bias. Poisoned inputs can cause persistent behavior that is hard to spot. The entry now includes fine-tuning subversion.
LLM06 Unbounded Consumption Uncontrolled use of the model causes denial of service, runaway cost or model cloning. Reasoning models, multimodal input and agent tool calls make expensive requests cheap for an attacker.
LLM07 Misinformation Wrong or unsupported output sounds credible enough to drive a decision, a workflow or an agent action. Over-reliance turns a wrong answer into a wrong action.
LLM08 Hidden Context Exposure Hidden context such as the system prompt, developer instructions, retrieved policy text or tool schemas is extracted or reconstructed. It replaces System Prompt Leakage. Assume hidden context is discoverable and never use it for secrets or as a security boundary.
LLM09 Vector and Embedding Weaknesses Attacks on embeddings and similarity search in RAG systems, vector memory and semantic caches. They can leak data between users or steer what gets retrieved. OWASP treats them as separate from prompt injection.
LLM10 Improper Output Handling Model output reaches browsers, databases, shells, terminals or tools without validation. It can lead to XSS, SSRF, privilege escalation or code execution. The entry now covers insecure AI-generated code.

What changed from 2025 to 2026

The same ten risk areas carry over. Nothing was added, removed, merged or split. What changed is the order, one name, and the evidence behind the ranking.

2026 item 2025 position Change
LLM01 Prompt Injection LLM01 No change
LLM02 Sensitive Information Disclosure LLM02 No change
LLM03 Excessive Agency LLM06 Up 3
LLM04 Supply Chain LLM03 Down 1
LLM05 Data and Model Poisoning LLM04 Down 1
LLM06 Unbounded Consumption LLM10 Up 4
LLM07 Misinformation LLM09 Up 2
LLM08 Hidden Context Exposure LLM07 System Prompt Leakage Renamed and broadened
LLM09 Vector and Embedding Weaknesses LLM08 Down 1
LLM10 Improper Output Handling LLM05 Down 5

Checked against real incidents for the first time

Earlier editions were ranked by practitioner vote alone. For 2026, OWASP gathered 7,714 real incidents from public vulnerability databases and an AI-harm database, classified the 6,639 that had enough detail, and compared them with the vote. The final ranking gives the community vote three-quarters of the weight and the incident data one quarter.

Two results stand out. On raw incident counts alone, prompt injection would drop out of the top ten. OWASP keeps it first, arguing that teams defend against it so heavily that fewer clean exploits reach public databases. Misinformation went the other way: voters ranked it low, the incident record ranked it high, and that pulled it up to seventh.

Existing entries grew

  • Prompt injection now covers cross-modal attacks, such as instructions hidden in an image or an audio track.
  • Supply chain now covers a promoted model artifact that is not what it claims to be.
  • Data and model poisoning now absorbs fine-tuning subversion.
  • Improper output handling now includes the insecure code that AI assistants generate.

Hidden Context Exposure (LLM08:2026) explained

Hidden context exposure replaces the 2025 entry for system prompt leakage. OWASP describes it as a broader framework for the same failure. It covers any hidden context that an attacker extracts, infers or reconstructs: the system prompt, developer instructions, retrieved policy text, tool and function schemas, and other instructions assembled behind the scenes.

It does not cover leaks of regulated user or training data, which stay under sensitive information disclosure (LLM02). Agent-specific versions, such as persistent memory and messages between agents, belong to the Agentic Top 10.

The practical guidance is short: assume anything in the hidden context can be discovered. Never put credentials or secrets there, and never rely on it as a security boundary.

The OWASP LLM risks most teams should tackle first

Every system is different, but for many production teams the first four items to take seriously are LLM01, LLM02, LLM03, and LLM10. They are the same four risks this guide recommended under the 2025 numbering, and they sit closest to everyday workflows, connected tools, and private data.

1. LLM01 Prompt injection

This is the category most readers already know, and for good reason. Prompt injection can arrive directly through a chat prompt or indirectly through webpages, files, tool output, search results, or retrieved text. It is the clearest example of instructions and data collapsing into each other. The 2026 entry makes explicit that the instruction can also hide in an image or audio.

If you are new to the topic, start with what prompt injection is, how indirect prompt injection works, how instructions hide in images, and how prompt injection differs from jailbreaking.

2. LLM02 Sensitive information disclosure

Many AI failures matter because they expose something that should have stayed private: customer records, confidential notes, credentials, PII, or internal context. In practice this category often combines with other items. Prompt injection can cause the leak. Excessive agency can widen the blast radius. Weak output handling can repeat or store the disclosure.

This is why teams should not frame AI security only as "did the model say something strange?" The harder question is whether it said something private.

3. LLM03 Excessive agency

Excessive agency means the system can do too much with too little review. It was the biggest climber in 2026, and OWASP notes that both the vote and the incident record point to agentic deployments as the place where damage is landing. A model that can browse, message, buy, update records, call tools, or expose context is much more dangerous than a model that can only answer text.

This is also why prompt injection and excessive agency amplify each other. The more authority an agent has, the more damaging a successful injection becomes.

4. LLM10 Improper output handling

OWASP moved this category from fifth to tenth. If your product passes model output into a browser, a query, a shell, a terminal, a tool call, or another agent step, it is still one of the first things to check.

The model can generate text, code, commands, URLs, or parameters. The real security failure happens when the surrounding system treats that output as trusted too soon. At that point you have moved from "the model might be wrong" to "the system might execute the mistake."

How to use the OWASP Top 10 in practice

The wrong way to use the list is to turn it into a checklist that says "we thought about all ten." The right way is to use it to drive design review, access-control decisions, red teaming, and testing.

  • Map each feature to the OWASP items it actually touches.
  • Prioritize the categories that can cause real harm in your workflow, not the ones that are easiest to talk about.
  • Ask where the model reads untrusted text, where it can reveal private data, where its output is trusted, and where it can act.
  • If your model can call tools or keeps memory, read the Agentic Top 10 alongside this list.
  • Use NIST-style risk language for governance and OWASP-style categories for engineering conversations.
  • Test high-risk flows with adversarial cases instead of treating a written policy as proof.

The simplest mental model is this: OWASP gives you the categories, NIST helps with program-level risk management, and red teaming shows whether your controls hold up under pressure.

Where Veridicus Scan fits

A post like this should not pretend one product solves the OWASP Top 10. It does not. But some categories do have obvious places for product controls. Veridicus Scan fits most naturally as a pre-ingestion and intake control for AI-bound content.

If your team feeds URLs, PDFs, DOCX files, images, extracted text, redirects, or parser-visible metadata into an LLM workflow, the first useful question is often whether that material should reach the model unchanged. That is where the product pages on coverage, URL scanning, report exports, and MCP automation fit into the OWASP picture.

In 2026 terms, Veridicus Scan is most relevant to LLM01 prompt injection, including instructions hidden in images. Checking documents before they enter a knowledge base can also support defenses against LLM05 data and model poisoning and LLM09 vector and embedding weaknesses. Reducing what reaches an agent helps contain LLM03 excessive agency, but it does not replace tool permissions or human approval. It is one control in the map, not the whole map.

What the OWASP Top 10 does not do

The list is useful because it creates a shared vocabulary. But it does not replace:

  • Threat modeling for your actual architecture
  • Least-privilege design for tools and agents
  • Input inspection and validation
  • Output validation and execution boundaries
  • Red teaming, logging, review, and incident response

The cleanest way to say it is that the OWASP Top 10 helps you see the terrain. It does not walk it for you.

Primary sources

The list, rankings, incident figures and definitions on this page come from OWASP's 2026 publication. Summaries are paraphrased; read the official text before relying on a detail.

FAQ

What is the OWASP Top 10 for LLM applications?

It is the OWASP GenAI Security Project's community list of the main security risks in LLM and generative AI applications. The current edition is the 2026 list, published on August 4, 2026.

What changed in the OWASP Top 10 for LLMs in 2026?

Excessive agency moved from sixth to third, unbounded consumption from tenth to sixth and misinformation from ninth to seventh. Improper output handling fell from fifth to tenth. System prompt leakage was renamed and broadened as hidden context exposure. For the first time, the ranking was checked against real incident data.

Is the OWASP Top 10 for LLMs only about prompt injection?

No. Prompt injection is one of ten entries. The list also covers sensitive information disclosure, excessive agency, supply chain, data and model poisoning, unbounded consumption, misinformation, hidden context exposure, vector and embedding weaknesses, and improper output handling.

What is hidden context exposure?

It is LLM08 in the 2026 list and replaces system prompt leakage. It covers attackers extracting or reconstructing hidden context such as system prompts, developer instructions, retrieved policy text and tool schemas. OWASP's advice is to keep secrets out of that context and not to treat it as a security boundary.

Which OWASP LLM risks matter first for most teams?

For many teams: prompt injection, sensitive information disclosure, excessive agency and improper output handling. They touch everyday agent behavior, connected tools and private data.

Does the OWASP Top 10 replace threat modeling or testing?

No. The OWASP Top 10 is a prioritization framework, not a full security program. Teams still need threat modeling, secure development, red teaming, access control design, and operational review.

How one scan relates to OWASP risks

This guide uses the OWASP Top 10 for LLM Applications 2026 edition. The sample scan demonstrates detection of an instruction-override phrase relevant to LLM01:2026 Prompt Injection. It does not establish coverage of all OWASP categories. Reviewing file evidence is only one input control; access control, output handling, human approval and application testing remain separate responsibilities.

Read the sample report · Review scan limits

OWASP: GenAI LLM Top 10 2026