The OWASP Top 10 for LLM Applications is the reference list of the ten most critical security risks in applications built on large language models, such as chatbots, copilots and agents. The current edition is the 2026 list, published in August 2026 by the OWASP GenAI Security Project, and prompt injection still sits at number one. If your company uses or builds a generative AI application, this list is the minimum your team or vendor should be able to show coverage for.
What the OWASP LLM Top 10 is and what changed in 2026
OWASP (Open Worldwide Application Security Project) is a nonprofit foundation that publishes open software security standards. Its LLM Top 10 started in 2023 and had a 2025 edition; the 2026 edition is the first to combine practitioner voting with a record of real-world incidents.
The most important changes from 2025:
- Excessive Agency climbs to number three (from sixth): agentic deployments that take actions are where the damage is landing.
- Unbounded Consumption rises four places, to sixth.
- Improper Output Handling drops from fifth to tenth, although it now also covers insecure code generated by AI assistants.
- System Prompt Leakage becomes Hidden Context Exposure, a broader framing of the same failure.
OWASP draws a clear boundary: this list covers the model as a component of your application. Once the model acts on its own (tools, memory, chained actions), pair it with the OWASP Top 10 for Agentic Applications, published in December 2025.
The 10 risks, with business examples
LLM01:2026 Prompt Injection
Text, a document, an image or a tool result changes the model's behavior in ways you did not intend. Example: a "customer" email with hidden instructions makes the support assistant reveal other customers' data. OWASP states that no fully reliable prevention exists today, so defense is architectural. We cover it in depth in our guide to prompt injection in AI agents.
LLM02:2026 Sensitive Information Disclosure
The system exposes confidential or personal data through an unauthorized channel: the answer, logs, tool arguments or retrieved chunks. Example: an internal HR assistant shows salary data to any employee who asks. Control: filter by the user's permissions before data reaches the model, not afterwards.
LLM03:2026 Excessive Agency
The model has more tools, permissions or autonomy than it needs, so an error or manipulation becomes a damaging action. Example: an agent meant to summarize email can also send and delete it. OWASP's controls: minimize tools and their functions, avoid open-ended tools (shell, arbitrary URL fetch), execute in the user's context and require human approval for high-impact actions.
LLM04:2026 Supply Chain
Tampered or dubious third-party models, adapters, datasets or packages. Example: pulling a "fine-tuned for legal" model from a public hub without checking who published it. Control: an AI bill of materials, verified sources, pinned versions and license review.
LLM05:2026 Data and Model Poisoning
Someone manipulates training, fine-tuning or knowledge-base data to plant bias or backdoors. Example: manipulated documents uploaded to a portal that feeds your assistant. Control: data provenance and validation, tight write access to sources, and behavioral regression tests after each update.
LLM06:2026 Unbounded Consumption
The app allows uncontrolled usage that spikes cost, degrades service or enables model extraction. Example: a public bot with no rate limiting gets scripted over a weekend and your AI provider bill multiplies. Control: per-user and per-IP limits, token caps, spend alerts and automatic cutoffs.
LLM07:2026 Misinformation
The model produces wrong but credible information, and a person or system acts on it. Example: a sales assistant invents a warranty term your company does not offer. Control: grounded answers with citable sources, validation of critical facts, and human review for consequential decisions.
LLM08:2026 Hidden Context Exposure
An attacker extracts the system prompt, internal rules or tool schemas. OWASP's guidance is to assume all hidden context is discoverable. Example: a chatbot prompt that contains an API key or internal credit approval criteria. Control: never put secrets or authorization logic in the prompt; enforce security outside the model.
LLM09:2026 Vector and Embedding Weaknesses
Weaknesses in the similarity-search layer that feeds the model, typical of RAG. Example: a vector store shared across tenants returns company A's chunks to a user from company B. Control: document-level access control at retrieval time, tenant isolation and validation of what gets indexed.
LLM10:2026 Improper Output Handling
Model output is passed downstream without validation, enabling XSS, SQL injection or remote code execution. Example: the model generates HTML your site renders unsanitized. Control: treat model output as untrusted user input, with validation, encoding and parameterized queries, exactly as you would in a secure API.
Summary table: risk, example, control
| Risk | Business example | Primary control |
|---|---|---|
| LLM01 Prompt Injection | Email with hidden instructions hijacks the assistant | Least privilege, human approval, isolate untrusted content |
| LLM02 Sensitive Info Disclosure | HR assistant leaks salaries | Permission filtering before the model |
| LLM03 Excessive Agency | Agent can send and delete email | Minimal tools, action approval |
| LLM04 Supply Chain | Model of unknown provenance | Inventory, verified sources, pinned versions |
| LLM05 Data and Model Poisoning | Tampered documents in the knowledge base | Provenance and write controls on sources |
| LLM06 Unbounded Consumption | AI bill spikes from abuse | Rate limits, caps, spend alerts |
| LLM07 Misinformation | Invented warranty term | Grounded answers, human review |
| LLM08 Hidden Context Exposure | API key inside the prompt | No secrets in prompts |
| LLM09 Vector and Embedding Weaknesses | RAG mixes tenants' data | Document-level access control |
| LLM10 Improper Output Handling | Unsanitized generated HTML | Validate and encode all output |
How to test an AI application
An AI penetration test focuses on LLM-specific risks and complements the traditional test of the application and its API. AI red teaming is the broader, ongoing version: simulating realistic adversaries against the whole system. Here is how our cybersecurity services team approaches it:
- Threat modeling: what data the model sees, which tools it can call, where untrusted content enters.
- Automated testing: attack suites with open-source tools such as garak or PyRIT to cover injection, leakage and tool abuse.
- Adaptive manual testing: OWASP warns that defenses that hold against static attacks often fail against attackers who know the defense, so testers must adapt.
- Classic infrastructure testing: authentication, authorization, APIs and cloud still produce most findings.
- Evidence-backed report and remediation plan, followed by a retest.
For pricing context, a pentest of a mobile app plus its API starts at USD 2,500 in 1 to 3 weeks; an LLM application adds scope based on the number of tools, data sources and integrations. See our guide on penetration testing types, scope and cost. To measure quality as well as security, add AI assistant evaluations.
Mapping to the NIST AI RMF
NIST's AI Risk Management Framework (AI RMF 1.0) organizes AI risk management into four functions: Govern, Map, Measure and Manage. Its Generative AI Profile, NIST AI 600-1 (July 2024), applies those functions to generative AI. The 2026 OWASP edition ships a mapping from each risk to both documents. In practice, OWASP tells you what can break technically, and NIST gives you the governance structure to manage it. For US companies, this pairing also produces evidence that SOC 2 auditors, HIPAA risk analyses and enterprise security questionnaires increasingly ask for when AI touches customer data.
Go-live checklist
- Inventory of models, providers, data sources and tools used by the application.
- Every tool scoped to minimum permissions, with credentials kept out of the prompt.
- Human approval for payments, outbound messages, deletions and configuration changes.
- Per-user access filters applied before document retrieval.
- Model output validated and encoded before it reaches the web, database or shell.
- Rate limits, token caps and spend alerts configured.
- Logs of prompts, tool calls and responses, with a defined retention period.
- AI security test completed and critical findings fixed.
- Incident response plan for data leakage or an unauthorized agent action.
Frequently asked questions
What is the latest version of the OWASP Top 10 for LLMs?
The 2026 edition, published in August 2026 by the OWASP GenAI Security Project. It replaces the 2025 edition and reorders several risks: Excessive Agency moves up to third, Unbounded Consumption to sixth, Improper Output Handling down to tenth, and System Prompt Leakage is broadened into Hidden Context Exposure. Prompt Injection remains number one.
How is the LLM Top 10 different from the classic OWASP Top 10?
The classic Top 10 covers risks in any web application, such as broken access control and injection. The LLM Top 10 covers risks introduced by language models: manipulation through text, leakage through model context, over-privileged agents and runaway cost. One does not replace the other; an AI application is still a web application with an API and needs both.
Does our customer support chatbot need an AI pentest?
If it only answers FAQs with no access to customer data, the risk is low and good practices plus basic testing are enough. If it looks up orders, accounts or personal data, or can take actions, a dedicated test before launch is worth it. The deciding factor is what data it can see and what it can do, not the size of your company.
Does using a major model provider protect us from these risks?
Only partially. Providers keep improving model robustness, but most Top 10 risks depend on how you build the application: which permissions you grant, which data you connect, how you validate output and what usage limits you set. That layer is your team's responsibility, not the model vendor's, and it is what auditors will ask you about.
How does the LLM Top 10 relate to SOC 2 or HIPAA?
Neither SOC 2 nor HIPAA names the OWASP LLM Top 10, but both expect you to identify and control risks to the data you handle. If your AI feature processes customer data or PHI, risks such as sensitive information disclosure or cross-tenant retrieval are exactly what your risk assessment must cover. Documented OWASP-based testing is practical evidence for both.
Conclusion
The 2026 OWASP LLM Top 10 confirms a shift: the risk is no longer only in what the model says, but in what it can do and which data it can reach. Prompt injection is still number one and has no definitive fix, so the controls that matter most are architectural: least privilege, human approval, output validation and usage limits.
If you are launching or already running an AI application, our cybersecurity services include OWASP-based security testing for LLM apps and agents, delivered by a nearshore team in UTC-5. Book a free consultation and we will scope the right test for your system.