October 21, 2025
Updated: August 27, 2026
All ten risks in OWASP's official 2026 order, what moved since the last edition, and concrete remediation for each.
Ahmed Ramdan
Large language models now sit inside customer service, finance, healthcare, and autonomous agentic AI workflows, and that reach has created a security surface traditional application testing never had to cover. The OWASP Top 10 for LLM Applications is the community-standard map of that surface. This guide covers the current 2026 edition (published August 4, 2026) in its official order, explains what moved since the 2025 list, anchors each risk to real attack scenarios (including the EchoLeak zero-click exploit against Microsoft Copilot), and gives concrete remediation for every entry.
Updated: August 2026. Reflects the OWASP LLM Top 10 2026 edition, which reordered eight of ten entries, promoted Excessive Agency to #3, and broadened System Prompt Leakage into Hidden Context Exposure.
Here is the official OWASP Top 10 for LLM Applications, 2026 edition, in rank order.
| Rank | Risk | What it is |
|---|---|---|
| LLM01 | Prompt Injection | Malicious input that overrides the model's intended behavior |
| LLM02 | Sensitive Information Disclosure | Leaking PII, secrets, or proprietary data through responses |
| LLM03 | Excessive Agency | An agent taking more real-world actions than its job requires |
| LLM04 | Supply Chain | Compromised models, datasets, adapters, or dependencies |
| LLM05 | Data and Model Poisoning | Tampering with training or fine-tuning data to plant behavior |
| LLM06 | Unbounded Consumption | Runaway resource use, denial of wallet, or model theft |
| LLM07 | Misinformation | The model generating and propagating false or unsafe output |
| LLM08 | Hidden Context Exposure | Leaking system prompts, RAG schemas, or hidden policy logic |
| LLM09 | Vector and Embedding Weaknesses | Attacks on RAG pipelines, vector stores, and embeddings |
| LLM10 | Improper Output Handling | Passing unvalidated model output into downstream systems |
The single most important takeaway: prompt injection has held the number-one spot across every edition, while Excessive Agency climbed sharply in 2026 as OWASP's community vote and incident evidence both reflected growing risk from agentic deployments.
If you learned this list from an older article, update your mental model, eight of the ten entries moved.
| Change | Detail |
|---|---|
| Excessive Agency #6 → #3 | The biggest jump. As LLMs gained tools, memory, and the ability to execute actions, over-permissioned agents became a top real-world risk |
| System Prompt Leakage → Hidden Context Exposure (LLM08) | Broadened beyond the system prompt to all non-user-visible context: RAG schemas, retrieved documents, hidden policy logic |
| Improper Output Handling fell to #10 | Still real, but ranked lower as the ecosystem matured its output-sanitization practices |
| Sensitive Information Disclosure held #2 | Data leakage remains one of the highest-priority LLM risks as more sensitive systems are wired to models |
| Reordered scope and examples | OWASP refreshed attack scenarios, mitigations, and framework mappings across the list |
For context, the prior 2025 edition (v2.0) had introduced System Prompt Leakage and split out Vector and Embedding Weaknesses; the 2026 edition builds on that with a heavy agentic-AI focus.
The 2026 edition is not just an editorial reshuffle. OWASP combined practitioner consensus with real-world incident evidence to produce the ranking.
That matters because the list now reflects both expert judgment and observed production failures, which is one reason agentic risks moved up so sharply.
| Risk | 2025 rank | 2026 rank | Change |
|---|---|---|---|
| Prompt Injection | 1 | 1 | Held |
| Sensitive Information Disclosure | 2 | 2 | Held |
| Supply Chain | 3 | 4 | Down 1 |
| Data and Model Poisoning | 4 | 5 | Down 1 |
| Improper Output Handling | 5 | 10 | Down 5 |
| Excessive Agency | 6 | 3 | Up 3 |
| System Prompt Leakage → Hidden Context Exposure | 7 | 8 | Broadened and moved down 1 |
| Vector and Embedding Weaknesses | 8 | 9 | Down 1 |
| Misinformation | 9 | 7 | Up 2 |
| Unbounded Consumption | 10 | 6 | Up 4 |
What it is: crafted input that overrides the model's intended instructions, often invisible to a human reviewer. It comes in direct form (a user manipulating the chatbot) and the more dangerous indirect form (malicious instructions hidden in a web page, document, email, or image the model later reads).
Why it still tops the list: in June 2025, EchoLeak (CVE-2025-32711, CVSS 9.3) demonstrated real zero-click indirect prompt injection against a production LLM system, Microsoft 365 Copilot, with data exfiltration possible without user interaction. A single crafted email chained bypasses across the LLM's trust boundary. That is prompt injection graduating from demo to production-grade exploitability. We cover the class in depth in our prompt injection attacks guide.
Remediation: enforce input/output filtering; separate trusted system instructions from untrusted content; constrain the model's privileges; require human-in-the-loop approval for high-impact actions; and treat all external content the model ingests as hostile.
What it is: the model revealing PII, credentials, or proprietary data, through its responses, memorized training data, or context it should not surface.
Attack scenarios: prompt-based exfiltration of customer records; unintended disclosure of training data; API keys leaking from a system prompt.
Remediation: deploy data-loss-prevention and redaction on inputs and outputs; keep secrets out of prompts entirely; apply differential-privacy techniques in training; and enforce strict, per-user access control on what the model can retrieve.
What it is: the 2026 riser. When an LLM agent can take actions, call APIs, run code, modify data, the risk is that it can do more than its task legitimately requires. Over-broad tools, permissions, or autonomy turn a wrong output into a wrong action.
Attack scenarios: an agent deleting or modifying critical data; autonomous API calls with no oversight; a prompt-injected agent chaining tool calls into real damage.
Remediation: apply least privilege to every tool and integration; minimize the actions an agent can take, not just the ones it should; require human confirmation for high-impact operations; and continuously log and audit agent activity. This is the same least-privilege discipline covered in our attack surface management guidance, applied to agents.
What it is: risk from third-party models, datasets, fine-tuning adapters (like LoRA), and ML dependencies, any of which can carry backdoors or vulnerabilities.
Attack scenarios: a compromised model pulled from a public repository; a tampered adapter introducing a backdoor; an outdated, vulnerable library in the ML stack.
Remediation: maintain an SBOM for model and data provenance; verify integrity with signatures and attestations; pin and scan dependencies; and treat model sourcing with the same rigor as any other third-party risk.
What it is: manipulating training or fine-tuning data to implant malicious behavior or bias, broadened in recent editions from just training data to the whole data-and-model lifecycle.
Attack scenarios: poisoned public datasets shifting model behavior; "split-view" poisoning during fine-tuning; a backdoor that triggers only on a specific phrase.
Remediation: verify data provenance; sandbox and monitor training for anomalies; watch for behavioral drift after deployment; and anchor outputs to verified data with retrieval-augmented generation (RAG).
What it is: uncontrolled resource use, replacing the older "Model Denial of Service" with a wider scope that also covers cost exhaustion ("denial of wallet") and model theft through repeated querying.
Attack scenarios: variable-length input floods; deliberately expensive queries draining your API budget; extended-reasoning token exhaustion; recursive agent or tool-call fan-out; model extraction via systematic querying.
Remediation: apply rate limits, quotas, and timeouts; cap input and output sizes; route by cost; and alert on unusual consumption spikes.
What it is: the model generating and propagating false or unsafe information, renamed from the old "Overreliance" to put the emphasis on the model producing falsehoods, not just users trusting them.
Attack scenarios: a financial assistant giving wrong investment guidance; a healthcare bot offering unsafe instructions; confidently fabricated citations.
Remediation: ground outputs with RAG over trusted sources; add fact-checking workflows; cross-verify high-stakes answers; and clearly communicate the model's limits to users.
What it is: the broadened successor to System Prompt Leakage. Beyond the system prompt, attackers extract any non-user-visible context, RAG schemas, retrieved documents, hidden policy or routing logic, that widens their capability once revealed.
Attack scenarios: extracting internal rules to bypass filters; discovering embedded credentials or keys; mapping the retrieval schema to craft better injections.
Remediation: never place secrets or trust-critical logic in prompts or context; isolate sensitive instructions; design assuming the context will leak; and monitor for extraction attempts.
What it is: vulnerabilities specific to RAG pipelines, vector stores, and embeddings, split out as its own risk because the attackers and defenses differ from prompt injection.
Attack scenarios: embedding inversion to reconstruct sensitive source data; poisoned vectors steering the model's reasoning; unauthorized access to a shared vector store.
Remediation: enforce fine-grained access control on vector databases; validate and sanitize what gets embedded; isolate tenants; and monitor knowledge-base integrity and retrieval logs.
What it is: passing unvalidated or unsanitized model output straight into downstream systems, effectively an injection vulnerability where the LLM is the untrusted source.
Attack scenarios: LLM output causing XSS, SQL injection, or code execution; generated Markdown or HTML carrying a malicious script.
Remediation: treat every model output as untrusted; sanitize and validate before use; apply parameterized queries and Content Security Policy; and encode output for its destination context. Because most LLM features ship inside a web app, this overlaps directly with standard application security testing.
The through-line of the 2026 edition is agents. When an LLM gains tools, memory, and autonomy, the classic risks compound: a prompt injection (LLM01) now drives a real action (LLM03) using leaked context (LLM08) and unsanitized output (LLM10). OWASP now maintains a companion Top 10 for Agentic Applications, and the practical lesson is that agent security is the sum of these risks plus rigorous least-privilege and human oversight. Treat every API, plugin, and tool an agent can reach as an untrusted, privileged surface, the same posture our API penetration testing applies to conventional integrations.
| Risk | What to test |
|---|---|
| LLM01 Prompt Injection | Direct and indirect injection through prompts, documents, web content, email, images, and RAG sources |
| LLM02 Sensitive Information Disclosure | Canary secrets, cross-user data access, training-data leakage, and context exfiltration |
| LLM03 Excessive Agency | Overprivileged tools, approval bypass, unsafe autonomous actions, and excessive API permissions |
| LLM04 Supply Chain | Model, adapter, dataset, and dependency provenance; integrity; version pinning; malicious packages |
| LLM05 Data and Model Poisoning | Tampered RAG data, poisoned fine-tuning sets, hidden triggers, and post-deployment behavioral drift |
| LLM06 Unbounded Consumption | Token/cost exhaustion, extended reasoning abuse, recursive agent/tool fan-out, and extraction attempts |
| LLM07 Misinformation | High-stakes false outputs, fabricated citations, unsafe recommendations, and weak grounding |
| LLM08 Hidden Context Exposure | System prompt, RAG schema, policy logic, tool metadata, and hidden routing-context extraction |
| LLM09 Vector and Embedding Weaknesses | Cross-tenant retrieval, poisoned vectors, unauthorized vector-store access, and embedding inversion |
| LLM10 Improper Output Handling | XSS, SQL injection, command execution, unsafe Markdown/HTML, and downstream parser abuse |
A mature test program combines automated guardrails with manual adversarial testing, because the most damaging failures often come from chained interactions across several categories rather than one isolated weakness.
You cannot buy a single product that closes this list; you build a layered program.
| Layer | What it does |
|---|---|
| Input/output guardrails | Filter, template, and validate everything in and out of the model |
| Least privilege for agents | Minimize tools, permissions, and autonomy; require approval for high-impact actions |
| Data protection | Redaction, DLP, differential privacy, strict retrieval access control |
| Supply-chain integrity | SBOM, provenance verification, dependency scanning |
| RAG and vector security | Access control, embedding validation, knowledge-base monitoring |
| Monitoring and observability | Semantic logging, anomaly detection, consumption alerts |
| Adversarial testing (red teaming) | Continuously probe for injection, poisoning, leakage, and agent abuse |
The last layer is the one most teams skip. Automated guardrails catch known patterns; a skilled red team finds the chained, creative paths, exactly the kind that turned EchoLeak from a theoretical bug into a zero-click data breach.
The LLM Top 10 is most useful when it is treated as one layer in a broader AI-security program.
The practical approach is to use the LLM Top 10 for risk coverage, ATLAS for adversary behavior, NIST AI RMF for governance, and vulnerability scoring or CWE mappings for remediation workflows.
The OWASP LLM Top 10 is not a static checklist; the 2026 edition moved eight of ten entries and pushed agentic risk to the front because that is where real incidents now cluster. Prompt injection remains the root of most LLM attacks, sensitive data disclosure and excessive agency are the fastest-rising consequences, and the defenses are a blend of AI-native guardrails and old-fashioned least privilege, input validation, and testing. Map your AI systems against the current list, layer your defenses, and test them adversarially before an attacker does.
DeepStrike's penetration testing includes LLM and AI-application testing that probes your models, agents, and integrations for the exact risks in this list, and hands you the fixes. For US-based teams, see our US penetration testing services.
Technical Review: DeepStrike Offensive Security Team
Last Reviewed: August 2026
It is a community-driven, standardized list of the ten most critical security risks facing applications built on large language models, maintained by the OWASP GenAI Security Project. The current 2026 edition, published August 4, 2026, ranks risks from LLM01 Prompt Injection to LLM10 Improper Output Handling.
Eight of ten entries moved. Excessive Agency jumped from sixth to third as agentic systems caused real damage, System Prompt Leakage was broadened into Hidden Context Exposure, Sensitive Information Disclosure held second, and Improper Output Handling fell to tenth. OWASP also refreshed scope, examples, and mitigations across the list.
Prompt injection is malicious input that overrides an LLM's intended instructions, either directly or hidden in content the model reads. It has topped every edition because it is the root cause of most LLM attacks. EchoLeak (CVE-2025-32711) in 2025 proved it can be weaponized for zero-click data exfiltration in production.
Excessive Agency is when an LLM agent can take more real-world actions, calling APIs, running code, modifying data, than its task legitimately needs. Over-broad permissions turn a wrong model output into a harmful action. It rose to third in 2026 as autonomous agents moved into production and began causing measurable damage.
No. LLMs are probabilistic and deeply integrated, so risk cannot be reduced to zero. But layered defenses, guardrails, least-privilege agents, data protection, supply-chain integrity, monitoring, and continuous adversarial testing, can dramatically reduce exposure and contain the impact when something does go wrong.
Combine automated guardrail and scanning tools with manual red teaming that probes each risk: attempt direct and indirect prompt injection, try to exfiltrate context and sensitive data, abuse agent tools, poison retrieval data, and pass malicious output downstream. Because most LLM features live in a web app, standard application penetration testing applies alongside AI-specific tests.
No. They are separate projects. The classic OWASP Top 10 covers web application risks like injection and broken access control; the OWASP Top 10 for LLM Applications covers AI-specific risks like prompt injection, model poisoning, and excessive agency. LLM apps need both, since they usually run inside a web application.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
