OWASP LLM Top 10 2026: The Full List and What Changed

The OWASP LLM Top 10 is a ranked list of the 10 most critical security risks in large language model applications, maintained by OWASP's GenAI Security Project.

The 2026 edition, released August 4, moved eight of the ten entries and renamed one.

I worked through the new release against the 2025 list to see what shifted. Here's the current ranking, what changed, and how it differs from OWASP's separate Agentic Top 10.

What is the OWASP LLM Top 10? The 30-second answer

The OWASP LLM Top 10 is a community-maintained ranking of the most critical risks facing applications built on large language models, covering the model as a component inside an app, not an autonomous actor.

Bottom line: it's the standard reference for LLM application security, now weighted in part by real-world incident data rather than practitioner opinion alone.

Key facts about the 2026 release

Here's what changed under the hood:

• Released: August 4, 2026, at Black Hat USA.
• Project leads: Steve Wilson and Rock Lambros.
• Methodology: 75% practitioner consensus, 25% weighted by 6,639 real-world incidents pulled from public vulnerability databases and an AI-harm database- the first time evidence has shaped the rankings.
• Scope: Risks where the model sits inside an application. Once a model gains tools, memory, and autonomous consequences, OWASP routes that risk to its separate Agentic (ASI) Top 10.

The OWASP LLM Top 10 2026: all 10 risks

Eight of ten entries moved from 2025, and one was renamed. Here's the current ranking:

LLM01:2026 Prompt Injection

Untrusted input alters model behavior because instructions and data share the same context window, with no equivalent of a parameterized query to separate them.

Stayed at #1. Mitigate with input segmentation, least-privilege tool access, and human approval on consequential actions.

LLM02:2026 Sensitive Information Disclosure

Models can surface training data, system context, or retrieved records they shouldn't expose.

Stayed at #2. Mitigate with output filtering, data minimization, and strict access scoping on anything the model can retrieve.

LLM03:2026 Excessive Agency

Excessive permissions, functionality, or autonomy let an LLM-based system take consequential actions with too little oversight.

Jumped from #6, the biggest move on the list, as agentic systems started causing real production incidents. Mitigate with scoped tool permissions and mandatory human sign-off on high-impact actions.

LLM04:2026 Supply Chain

Vulnerabilities in pre-trained models, training data, plugins, and dependencies carry into anything built on top of them.

Dropped from #3. Mitigate with model provenance checks and vetting third-party components before deployment.

LLM05:2026 Data and Model Poisoning

Manipulated training, fine-tuning, or embedding data introduces vulnerabilities or biases into a model's behavior.

Dropped from #4. Mitigate with data provenance tracking and anomaly detection on training pipelines.

LLM06:2026 Unbounded Consumption

Excessive, uncontrolled inference lets attackers drain compute budgets or degrade availability.

Up from #10, with scope widened to include Denial of Wallet attacks that exhaust inference budgets without crashing anything. Mitigate with rate limiting and per-user cost caps.

LLM07:2026 Misinformation

Confidently generated but incorrect output causes harm, especially when it feeds automated workflows or triggers API calls downstream.

Up from #9, pulled higher by incident data after practitioners had ranked it too low. Mitigate with retrieval grounding and human review before high-stakes actions execute.

LLM08:2026 Hidden Context Exposure

Renamed from System Prompt Leakage, now covering any non-user-facing content assembled into a model's context, including retrieved policy text, tool schemas, and workflow rules.

Mitigate by assuming all context is discoverable and never placing secrets there.

LLM09:2026 Vector and Embedding Weaknesses

Vulnerabilities in retrieval-augmented generation systems let attackers manipulate embeddings or poison the retrieval pipeline.

Dropped from #8. Mitigate with access controls on vector stores and validation of retrieved content before use.

LLM10:2026 Improper Output Handling

Insufficient validation of model output before it's passed to downstream systems, functionally similar to cross-site scripting.

Dropped sharply from #5. Mitigate by treating all model output as untrusted input to whatever system receives it next.

OWASP LLM Top 10 vs. OWASP Agentic (ASI) Top 10: what's the difference?

Both lists come from OWASP's GenAI Security Project, but they cover different layers of risk. Getting the scope right determines which framework governs your testing.

The two lists complement each other instead of competing. A single application can need both if it starts as a standard LLM feature and grows into an autonomous agent.

What's new in the 2026 update

The philosophy behind the list is the biggest change this year, not any single risk.

The project leads have reframed the goal from building a model that can't be fooled to hardening the application around it, so that a successful attack has a limited blast radius rather than direct access to consequential systems.

The other structural change is the evidence weighting. Past editions ran entirely on practitioner votes.

This edition let real incident data move Misinformation and Unbounded Consumption higher than consensus alone would have ranked them, while the vote still carried three-quarters of the weight.

Should you use the OWASP LLM Top 10? My take

If you're building or deploying anything that puts an LLM in front of real users or real data, this is the baseline checklist to test against, not an optional reference.

The OWASP LLM Top 10 is essential for:

• Teams shipping LLM-powered features to production.
• Security teams building AI-specific threat models.
• Anyone needing to map AI risk to NIST, MITRE ATLAS, or compliance frameworks.

Add the Agentic Top 10 if you:

• Deploy agents that call tools, retain memory, or act with limited human oversight.

For teams building internal tools with AI, not customer-facing LLM features, our vibe coding security guide covers where these same risks show up in AI-generated code.

How to test your LLM application against the Top 10 in 5 steps

Testing works best as a structured pass through each risk category instead of an ad hoc review:

1. Map your architecture. Identify every point where untrusted input reaches the model and where model output reaches another system.
2. Test the top two first. Attempt prompt injection and probe for sensitive data disclosure, since these remain the highest-incidence risks by a wide margin.
3. Audit agent permissions. If any component acts autonomously, review exactly what it can do and whether high-impact actions require approval.
4. Check output handling. Confirm model output is validated before it reaches a database, a shell, or another API, the same way you'd treat user input.
5. Review your context assembly. Verify that system prompts, retrieved policy text, and tool schemas can't be leaked to a user who shouldn't see them.

Pro tip: Re-run this pass whenever you add a new tool, data source, or model version after the initial launch.

Best practices for applying the OWASP LLM Top 10

A few habits keep this from becoming a one-time compliance exercise:

• Automate what you can: Manual review doesn't scale to how quickly LLM applications change, so wire testing into CI/CD where possible.
• Map to frameworks you already use: OWASP's Appendix A ties each risk to NIST AI RMF, MITRE ATLAS, and CWE, so this doesn't have to live in isolation.
• Revisit rankings on release: With eight of ten entries moving this year, treat the list as current guidance you revisit, not a fixed checklist you memorize once.

My verdict on the OWASP LLM Top 10

The 2026 release is a meaningful change, not a routine update.

Excessive Agency jumping from sixth to third reflects what's happening in production as agentic systems take on more consequential work.

The incident-weighted methodology gives the rankings real teeth for the first time.

Treat it as the starting checklist for any LLM application, and pair it with the Agentic Top 10 the moment your system starts acting instead of simply responding.

Where Superblocks fits

Several of these risks, Excessive Agency and Improper Output Handling especially, show up just as much in the internal apps and agents business teams build with AI as in customer-facing LLM features.

Superblocks is the governed enterprise vibe coding platform, built on a SOC 2 and HIPAA-aligned foundation, where those apps run inside guardrails from the start.

RBAC and audit logs apply automatically instead of getting bolted on after the fact.

Shadow AI is the new shadow IT, and it's exactly where ungoverned agent permissions and unvalidated output tend to hide.

Flex runs 70 apps daily across 18 departments with IT keeping full control at scale.

For the deeper practice of securing LLM applications generally, see our guides to enterprise LLM security and enterprise-grade LLM applications.

Our guides to AI model governance and AI risk management cover how this checklist fits into a broader program.

To try governed app building for yourself, start with the Superblocks Quickstart Guide.

Or book a demo to see Clark AI generating governed apps in your own environment.

Frequently asked questions

What is the OWASP LLM Top 10?

The OWASP LLM Top 10 is a ranked list of the most critical security risks in large language model applications, maintained by OWASP's GenAI Security Project, covering prompt injection, excessive agency, and output handling.

What changed in the OWASP LLM Top 10 2026?

Eight of ten entries moved, and one was renamed in the OWASP LLM Top 10 2026. Excessive Agency jumped from sixth to third, Prompt Leakage became Hidden Context Exposure, and Output Handling dropped to tenth.

What is the difference between the LLM Top 10 and the Agentic Top 10?

The difference between the LLM Top 10 and the Agentic Top 10 lies in which layer of risk each covers. The LLM Top 10 covers a model as a component inside an app. The Agentic Top 10 covers a model that acts autonomously using tools and memory.

What tool helps secure AI-built apps against these risks?

For AI-built internal apps specifically,  Superblocks applies RBAC, audit logs, and access control automatically as apps are built. Dedicated testing tools remain the right choice for customer-facing LLM features.

Is prompt injection still the top risk in 2026?

Yes, Prompt Injection remains LLM01 in the 2026 edition, unchanged from every previous release, since instructions and untrusted data still share one context window with no complete fix yet.