OWASP Top 10 for LLM Applications

What is the OWASP Top 10 for LLM Applications?

The OWASP Top 10 for LLM Applications is a list of the ten security risks that show up most in software built on a language model. It is written by the OWASP GenAI Security Project, a volunteer group of security researchers and vendors, so that everyone in a room uses the same words for the same problem.

OWASP is the Open Worldwide Application Security Project, a nonprofit foundation that started in 2001 and has published a Top 10 for web application security since the early 2000s. OWASP calls that an awareness document, and the phrase is worth taking literally: there is no audit and no such thing as being OWASP-compliant. What you get is shared vocabulary and a list to walk before you put something in front of customers.

The current edition is dated 2026 and was published on 4 August 2026. The year is part of the identifier on purpose, because the numbers move between editions.

The editions and why the year matters

Three editions exist and all three are still being quoted somewhere. The 2023 edition (version 1.0 on 1 August 2023, version 1.1 that October) had insecure plugin design, model denial of service and model theft as separate entries. The 2025 edition, published in November 2024, added system prompt leakage and vector and embedding weaknesses, and pulled service disruption and model theft together under one entry, unbounded consumption. That is the numbering most blog posts and vendor pages still use. The 2026 edition moved eight of the ten entries and renamed one.

It also changed how the order gets decided. Earlier lists ranked risks purely on what the community voted for. This one keeps the vote at three quarters of the weight and gives the last quarter to 6,639 real incidents pulled from public vulnerability databases and an AI harm database. The two disagree in places: prompt injection came first in the vote but falls out of the ten entirely on incident count, which the project reads as a sign that teams defend it well.

Not every OWASP page updated at the same moment, so an overview page or a translated PDF can still hand you the 2025 list. Look for the year in the identifier before you copy a number.

The ten risks in the 2026 edition

1. LLM01:2026 Prompt Injection
   Input reaches the model and changes its behaviour in a way you did not intend, whether it came from a user, a retrieved document, a tool result or an image. Prompt injection has its own entry.

2. LLM02:2026 Sensitive Information Disclosure
   The system hands out confidential or regulated data through a channel nobody approved. The answer text is the obvious route; logs, retrieved chunks and tool arguments are the ones people forget.

3. LLM03:2026 Excessive Agency
   The system can do more than the task needs: too many tools, too many permissions, too little human oversight. Bad model output only becomes damage when there is somewhere for it to go. There is a separate entry on excessive agency.

4. LLM04:2026 Supply Chain
   The models, adapters and datasets you did not build and cannot easily inspect. A fine-tuning adapter pulled off a model hub is a dependency that no build pipeline checks.

5. LLM05:2026 Data and Model Poisoning
   Someone manipulates what the model learns from, during pre-training, fine-tuning, embedding or a continuous learning loop. Data poisoning has its own entry.

6. LLM06:2026 Unbounded Consumption
   Nothing limits how much inference the system will do, so an attacker can take the service down, run your bill up, or copy the model by querying it often enough. The money half of this is the denial of wallet entry.

7. LLM07:2026 Misinformation
   Output that is wrong or unsupported, and fluent enough that someone acts on it. Overreliance sits in the same entry, because a confident answer nobody checks is a design choice.

8. LLM08:2026 Hidden Context Exposure
   Someone extracts or reconstructs what you assembled behind the scenes: the system prompt, the policy text your retrieval pulled in, the tool schemas. This was system prompt leakage in 2025, renamed because the prompt was never the only hidden thing in the context window.

9. LLM09:2026 Vector and Embedding Weaknesses
   The retrieval layer is part of your trust boundary. Planted content can rank high enough to be retrieved and believed, and similarity search often runs across the whole index before your access rules apply. RAG poisoning is covered separately.

10. LLM10:2026 Improper Output Handling
    Model output goes downstream unchecked, into a shell, a SQL query or a browser. It fell from fifth place to tenth, which says more about how well the fix is understood than about how often it happens.

What moved, and what that means for a policy you already wrote

If your AI policy or supplier questionnaire cites a bare LLM number, it is now ambiguous. Excessive agency went from LLM06 to LLM03, so the number most people memorised means something else. Improper output handling went from LLM05 to LLM10 and unbounded consumption from LLM10 to LLM06, so an old reference to LLM10 and a new one point at opposite risks. System prompt leakage (LLM07) became hidden context exposure (LLM08).

The fix is one search and replace: write LLM03:2026 rather than LLM03. The next reordering then reads as an outdated reference instead of a wrong one.

How it relates to the agentic list

The same project publishes the OWASP Top 10 for Agentic Applications, numbered ASI01 to ASI10, and the dividing line is what the thing under attack is allowed to do. The LLM list assumes the model is a component inside your application: text goes in, text comes out, your code decides what happens next. The agentic list assumes the model is the one deciding, with tools it can call and memory it carries between sessions. Several risks appear on both lists from different angles. Prompt injection is LLM01; once the reader can act, the same technique is agent goal hijack (ASI01). LLM05 covers training and retrieval data, memory poisoning (ASI06) covers what the agent wrote down about you last month.

Where an SME with one assistant starts

Ten entries is a lot for a company running one assistant on a vendor product. Three are worth an afternoon. Prompt injection is deliberately not among them: it is number one and you cannot buy a fix for it, so what you control is how little the model can reach when an injection lands.

LLM02 Sensitive Information Disclosure, because you chose the reach yourself. Whatever the assistant may read, it may repeat. Which shared drives did you point it at, and who else sees the answers?

LLM03 Excessive Agency, because it decides how bad the other nine get. An assistant that only writes text has a small blast radius. The moment it gets a tool that sends, pays or deletes, every other entry gains a consequence. Ask which actions run without a human click, and take away the ones nobody asked for.

LLM06 Unbounded Consumption, because it costs you money without anyone attacking you. The usual cause is your own automation looping or a document set bigger than anyone estimated. A hard spend cap and an alert are an hour of work.

The other seven are worth reading once, and worth working through properly the day the assistant gets a second tool.