OWASP Top 10 for Large Language Models: The 2026 List and What Changed

The OWASP Top 10 for Large Language Model Applications was updated for 2026, and the ranking changed with it. If your team is still scoping LLM tests against the older list, you are prioritizing last year's threat model.

‍

This guide gives the current 2026 list in order, what moved since 2025, and how we test against each risk. It is a reference page, so it states the taxonomy exactly as OWASP publishes it.

‍

What is the OWASP Top 10 for LLM Applications?

‍

The OWASP Top 10 for LLM Applications is a community-built, periodically updated ranking of the most critical security risks specific to applications powered by large language models. It is published by the OWASP GenAI Security Project, maps each risk to frameworks such as NIST and MITRE ATLAS, and is the de facto reference for scoping LLM security testing.

‍

What are the OWASP Top 10 for LLMs in 2026?

‍

The 2026 list, in order, is: prompt injection (LLM01), sensitive information disclosure (LLM02), excessive agency (LLM03), supply chain (LLM04), data and model poisoning (LLM05), unbounded consumption (LLM06), misinformation (LLM07), hidden context exposure (LLM08), vector and embedding weaknesses (LLM09), and improper output handling (LLM10).

‍

1. LLM01 — Prompt Injection. Crafted input, direct or indirect, that overrides the model's intended instructions.
2. LLM02 — Sensitive Information Disclosure. The model reveals confidential data — training data, secrets, or other users' data — through its outputs.
3. LLM03 — Excessive Agency. A model granted too much permission, autonomy, or tool access takes damaging actions. The biggest riser in 2026, up from sixth, as agentic systems spread.
4. LLM04 — Supply Chain. Compromised models, datasets, adapters, plugins, or dependencies anywhere in the LLM supply chain.
5. LLM05 — Data and Model Poisoning. Manipulation of training or fine-tuning data, or the model itself, to implant bias or backdoors.
6. LLM06 — Unbounded Consumption. Uncontrolled resource use — compute, tokens, and cost — including denial-of-wallet and model-extraction abuse. Up from tenth.
7. LLM07 — Misinformation. Confident but wrong or fabricated output that users over-trust. Up from ninth.
8. LLM08 — Hidden Context Exposure. Leakage of system prompts, tool definitions, and other hidden context. Renamed and broadened from 2025's "System Prompt Leakage."
9. LLM09 — Vector and Embedding Weaknesses. Attacks on the embeddings and vector store behind retrieval-augmented generation, including poisoning and cross-context leakage.
10. LLM10 — Improper Output Handling. Downstream systems trusting LLM output without validation, enabling cross-site scripting, SSRF, or code execution. Down from fifth.

‍

‍

What changed from 2025 to 2026?

‍

Eight entries carried over with new rankings, one was renamed, and OWASP's methodology now weighs real-world incident data alongside practitioner consensus. Prompt Injection (LLM01) and Sensitive Information Disclosure (LLM02) held the top two. The moves that matter:

‍

• Excessive Agency jumped to LLM03 from sixth — the largest single move, reflecting how quickly tool-using and agentic LLMs have been deployed.
• System Prompt Leakage became Hidden Context Exposure (LLM08), broadened beyond the system prompt to tool definitions and other hidden context.
• Unbounded Consumption rose to LLM06 (from tenth) and Misinformation to LLM07 (from ninth).
• Improper Output Handling fell to LLM10 (from fifth), while Supply Chain and Data and Model Poisoning each shifted down one place.

‍

Why the reshuffle matters for how you test

‍

Excessive Agency moving to third is the signal to read. It means the highest-value LLM tests now target what an agent can do — its tool permissions, the scope of actions it can take, and whether a human checkpoint exists — not just what it can be tricked into saying. A test plan built around the 2025 ordering under-weights exactly the risk that rose fastest.

‍

How does ioSENTRIX test against the OWASP LLM Top 10?

‍

We test the way we test any control: not by confirming it exists, but by trying to break it. Prompt injection and hidden context exposure are probed with adversarial and indirect-injection inputs; excessive agency by abusing tool permissions and action scope; improper output handling by injecting through the model into downstream systems; and vector and embedding weaknesses by attempting to poison or leak across a retrieval corpus. Findings are graded on evidence, not on whether a safeguard is present. That discipline is the subject of our AI security assessment approach, and it is why a willing, fluent model answer still has to be checked for correctness.

‍

Frequently asked questions

‍

What is the top OWASP LLM risk in 2026?

Prompt Injection (LLM01) remains the number-one risk in the 2026 list, unchanged from prior editions. It covers both direct prompt injection and indirect injection through content the model ingests.

‍

Is there a separate OWASP Top 10 for Agentic Applications?

Yes. The OWASP GenAI Security Project publishes a separate Top 10 for Agentic Applications alongside the LLM list, and the 2026 LLM list cross-references it. If you run tool-using agents, scope against both.

‍

Does the 2026 list replace the 2025 one?

Yes. The 2026 edition is current and should be cited for any new LLM testing scope. The 2025 ordering is superseded, most notably by Excessive Agency rising to LLM03.

‍

How often is the OWASP LLM Top 10 updated?

Periodically, by the OWASP GenAI Security Project, as the threat landscape shifts. Treat the newest edition as authoritative and re-scope your testing when it changes.

‍

ioSENTRIX Can Help

‍

ioSENTRIX is a CREST-accredited, ISO/IEC 27001 certified penetration testing firm. Our AI and ML penetration testing maps directly to the current OWASP Top 10 for LLM Applications, with evidence for each finding rather than a checklist of controls. If you are deploying an LLM or agentic application, contact ioSENTRIX to scope testing against the 2026 list.

‍

Keep reading

‍

• AI Security Assessment: Prove Controls, Don't Assert Them
• AI Data Leakage Testing: Has Anyone Tested Your AI Policy?
• Compliant Is Not Correct: When Security AI Gives a Wrong Command