A model returns a string that looks harmless in a chat window. An application sends the same string to a browser, SQL interpreter, shell, payment tool, or another model with broader authority. The binding between that output and the downstream system turns model-controlled data into an effect.
The OWASP Top 10 for LLM Applications 2026 maps those boundaries. OWASP's 122-page guide covers inputs, hidden context, training and retrieval data, model artifacts, generated output, tools, and resource consumption. Its scope line matters during architecture review: this list follows the model as a component. The separate Agentic Top 10 follows a model that can act.
OWASP announced the edition with a September 2, 2026 dateline and reported more than 10,000 downloads in its first 48 hours. The resource page is dated August 3, and the PDF's publication fields still contain placeholders. Treat September 2 as the public announcement date and record the version you reviewed rather than assuming the cover metadata is final.
The 2026 list as an application review#
| Rank | OWASP risk | Engineering review question |
|---|---|---|
| LLM01 | Prompt Injection | Which untrusted text, files, images, tool results, or memories share context with instructions, and what happens after the model follows them? |
| LLM02 | Sensitive Information Disclosure | Which confidential data can enter model context or output, and which users, logs, providers, or downstream systems can receive it? |
| LLM03 | Excessive Agency | Which tools, functions, permissions, and autonomous steps exceed the narrow task the application needs? |
| LLM04 | Supply Chain | Can the team verify the origin, integrity, evaluation history, and update path of models, adapters, datasets, libraries, and hosted services? |
| LLM05 | Data and Model Poisoning | Who can change training, fine-tuning, feedback, evaluation, and retrieval inputs, and how would a targeted change be detected? |
| LLM06 | Unbounded Consumption | What limits requests, tokens, recursion, fan-out, model extraction, and spending per user, tenant, and workflow? |
| LLM07 | Misinformation | Where can an unsupported or fabricated claim influence a person or automated decision without suitable evidence? |
| LLM08 | Hidden Context Exposure | Does hidden context contain secrets or security logic whose disclosure would increase attacker capability? |
| LLM09 | Vector and Embedding Weaknesses | Can a tenant, document, or query cross an authorization boundary through retrieval, index poisoning, or embedding inversion? |
| LLM10 | Improper Output Handling | Which parsers, renderers, interpreters, or APIs consume model output without validation and encoding for that exact sink? |
Risk order does not equal remediation order for a particular product. A customer-support assistant with no tools may need to address data disclosure before agency. A coding assistant that can execute shell commands may be blocked by LLM10 or LLM03 even though those entries sit below prompt injection. Trace each reachable path from untrusted input to business impact, then use the list to check what the path analysis missed.
See how your AI systems hold up under real attacks
General Analysis maps AI applications and agents, red teams prompts, retrieval, tools, MCP servers, browser actions, permissions, and business workflows, then turns findings into evidence your team can reproduce and retest.
What the evidence-weighted ranking tells you#
Earlier editions were based on practitioner judgment. For 2026, OWASP says it assembled 7,714 public incidents from vulnerability databases and an AI-harm database, then classified 6,639 with enough detail. Community voting carries 75 percent of the final ranking; the incident record carries 25 percent.
That weighting produced several visible changes from 2025:
- Excessive Agency rose to third as expert judgment and incident evidence converged.
- Unbounded Consumption moved up four places.
- Improper Output Handling fell from fifth to tenth.
- System Prompt Leakage became Hidden Context Exposure, broadening the category beyond a literal system prompt.
- Prompt Injection remained first even though OWASP says raw incident counts would put it outside the top ten.
OWASP interprets the prompt-injection gap as a defense effect: organizations invest in mitigating it, so fewer clean incidents enter public databases. The same document says incident evidence ranked Misinformation much higher than voters did. The disagreement exposes the limits of expert intuition and public reports. It does not establish the rate of either failure in your application.
Public incident data is shaped by reporting, disclosure, classifier accuracy, and the detail available in each record. The 75/25 blend is a transparent prioritization choice, not a quantitative risk model. Do not turn rank one into a universal likelihood score or rank ten into permission to ship an unsafe output sink.
Know when the model becomes an actor#
OWASP draws its scope line at agency. The LLM list owns failures where the model is a component in an application. When the model chooses tools, persists memory, talks to peers, or sets consequences in motion, OWASP says to pair it with the Agentic Top 10.
A team tests whether a model can be prompted to request a dangerous transfer, records a jailbreak rate, and calls LLM01 covered. The transfer remains possible because the agent has an overpowered payment tool and no independent authorization. The model-input failure belongs to LLM01. The authority and effect path belongs to LLM03 and to agentic risks such as tool misuse and privilege abuse.
For systems with tools, use our OWASP Top 10 for Agentic AI guide alongside this page. If the architecture has a runtime policy decision between model output and an action, the OWASP Agent Control Standard guide explains how to test whether that decision actually occurs before the effect.
Four decisions the revision should change#
1. Design for prompt injection to succeed#
Prompt injection remains LLM01 because instructions and untrusted data reach the model through the same token stream. Input filters and model refusals can lower attack success, but they cannot create a hard trust boundary inside that stream.
Map each input source: user messages, retrieved documents, images, audio, tool responses, conversation history, and durable memory. Then bound what a compromised model can disclose or cause. Remove unnecessary tools, narrow credentials and function parameters, require independent authorization for consequential actions, and keep egress destinations explicit. Our AI guardrails guide explains where probabilistic checks help and where deterministic enforcement has to carry the decision.
2. Separate wrong output from unsafe output handling#
The 2026 taxonomy distinguishes three output-side failures that need different evidence:
| Failure | Example | Primary control |
|---|---|---|
| Sensitive Information Disclosure | The response reveals another tenant's document | Data authorization, context minimization, output inspection, and log controls |
| Misinformation | The response invents a policy citation that a reviewer accepts | Retrieval provenance, claim verification, abstention, and human review for consequential decisions |
| Improper Output Handling | The application renders model HTML or passes model text to a shell | Sink-specific validation, encoding, parameterization, isolation, and least privilege |
An audit that reports only one “output safety” score hides these differences. Test each failure at the component that owns it. Citation accuracy belongs in the decision workflow. HTML encoding belongs in the renderer. Shell argument construction belongs in deterministic application code. A general model evaluation cannot prove those downstream controls exist.
3. Treat promoted model artifacts as supply-chain changes#
LLM04 now explicitly includes the case where a promoted model artifact is not what it claims to be. Record the model and adapter digest, provider and endpoint, dataset and evaluation lineage, license, approval, and rollout event. Resolve mutable aliases to the immutable artifact actually served. Re-run security evaluations when any of those bindings change.
That record should cover hosted services as well as local weights. A stable model name can point to changed behavior, a new system prompt, a new tool schema, or a revised moderation layer. The deploy decision needs a versioned evidence bundle even when the provider abstracts the artifact away.
4. Put budgets around every multiplicative path#
Unbounded Consumption rose four places. Per-request rate limits are too narrow for an application that can recurse, call subagents, fan out retrieval, or trigger expensive tools. Set budgets for tokens, steps, wall-clock time, concurrent work, retries, network calls, and money. Enforce them per request, user, tenant, and workflow, and stop the work when a budget expires.
Watch both availability and extraction. A low-volume sequence of carefully chosen queries may stay under a traffic threshold while still extracting model behavior or sensitive embeddings. Cost telemetry, anomaly detection, and response throttles should retain the identity and workflow that created the consumption.
Hidden context is not an authorization layer#
The renamed LLM08 is a useful architecture test. Assume that system prompts, developer instructions, tool schemas, retrieved policy text, and other model-visible context can be inferred or extracted. Keep credentials, connection strings, private keys, and bearer tokens outside it. Do not rely on a secret instruction to enforce authorization, content policy, or privilege separation.
This does not make every disclosed prompt a severe vulnerability. Severity depends on what the context contains and what disclosure unlocks. A generic writing instruction may be harmless. An embedded API token or approval rule can turn disclosure into data access or privilege escalation. State the concrete impact instead of assigning severity from the phrase “system prompt leak.”
Evidence to require before release#
Turn the ten categories into a small set of artifacts that can be inspected and retested:
- A trust-boundary and data-flow map showing every untrusted input, model context, retrieval store, model or adapter, output sink, tool, identity, and external effect.
- An immutable component record for models, datasets, adapters, libraries, providers, and their update channels.
- A capability and authorization matrix that maps each task to the minimum tools, functions, credentials, data scopes, approvals, and budgets it needs.
- Sink-level tests that feed adversarial model output into every renderer, parser, interpreter, and API adapter.
- Retrieval isolation tests for tenant filters, access changes, poisoned documents, deleted content, conflicting evidence, and embedding reconstruction.
- Failure and telemetry tests for timeouts, retries, budget exhaustion, blocked actions, human approval, and policy-service outages.
Use the 2026 list to label gaps in those artifacts. Use a threat model to decide severity and ownership. Use repeatable tests to prove the control still holds after a model, dataset, prompt, connector, or policy change. The NIST Generative AI Profile offers a broader risk-management companion, while our AI red teaming guide covers how to exercise the resulting attack paths.
An application is ready for review when each reachable boundary has an owner, a concrete enforcement point, and a test that fails when the enforcement disappears. The OWASP rank can order the first pass. The system's data, authority, sinks, and budgets decide what blocks release.
