)
Last updated: October 28, 2026
What is the OWASP Top 10 for LLM applications 2026, and what changed? It is the OWASP GenAI Security Project's ranked list of the ten most serious security risks in applications built on large language models, published in August 2026. Prompt Injection stays first, Excessive Agency climbs to third, and System Prompt Leakage becomes Hidden Context Exposure.
TL;DR: Key Takeaways
- The list was published in August 2026. The OWASP GenAI Security Project says it passed 10,000 downloads in its first 48 hours.
- Nothing was dropped. Eight of the ten positions changed against the 2025 list and new risks were folded into existing entries, as the OWASP 2026 guide and the Cloud Security Alliance (October 21, 2026) describe.
- Excessive Agency jumped from sixth to third, and Unbounded Consumption from tenth to sixth. Agents that call tools make both risks more costly.
- The ranking mixes votes and data. According to the OWASP 2026 guide, the community vote carries 75% of the weight and incident data 25%, drawn from 7,714 public incidents, of which 6,639 were classified.
- Real incidents map to the list. EchoLeak (CVSS 9.3), the LiteLLM package compromise of March 24, 2026 and a stored XSS in AnythingLLM (CVE-2026-41318) each match a specific entry.
- A runtime layer covers part of the list, not all of it. Training data, vector databases and application code stay with you, as the mapping below shows.
Key Facts at a Glance
| 2026 | Risk | 2025 position | Change |
|---|---|---|---|
| LLM01 | Prompt Injection | 1 | Same rank, wider scope |
| LLM02 | Sensitive Information Disclosure | 2 | Same rank, wider scope |
| LLM03 | Excessive Agency | 6 | Up 3 |
| LLM04 | Supply Chain | 3 | Down 1 |
| LLM05 | Data and Model Poisoning | 4 | Down 1 |
| LLM06 | Unbounded Consumption | 10 | Up 4 |
| LLM07 | Misinformation | 9 | Up 2 |
| LLM08 | Hidden Context Exposure | 7 (System Prompt Leakage) | Renamed and broadened |
| LLM09 | Vector and Embedding Weaknesses | 8 | Down 1 |
| LLM10 | Improper Output Handling | 5 | Down 5 |
What Is the OWASP Top 10 for LLM Applications 2026?
The OWASP Top 10 for LLM Applications 2026 is a prioritized list of the ten risk categories most relevant to software that uses large language models. It is a threat-modeling guide, not a vulnerability scanner or a compliance standard. OWASP ranks risks by community votes tested against real incidents.
OWASP says the ranking was checked against thousands of real-world incidents and adds mappings to NIST, MITRE ATLAS and CWE. OWASP also says incident data can move an entry by a tier but cannot override the community vote on its own. The Cloud Security Alliance notes that the list guides priorities and does not measure likelihood, because incident data is incomplete and categories overlap.
How we read the list
For each risk we give the change from 2025 and a dated real case where one is documented. Where we found no verifiable public incident, we say so. For agent risks, see the OWASP Top 10 for Agentic Applications 2026, and for tool protocols the OWASP MCP Top 10.
)
What Changed Since the 2025 List
Three changes matter most. Excessive Agency and Unbounded Consumption rose because models now call tools and run long loops. System Prompt Leakage was renamed Hidden Context Exposure. Several entries gained scope, and none was removed. Eight of the ten numbers moved.
Excessive Agency rose because erroneous or manipulated output can now trigger real actions in external systems. Unbounded Consumption rose because the entry now adds denial of wallet, service disruption and model extraction. Hidden Context Exposure covers developer instructions, tool schemas, retrieved policy text and workflow criteria, not only the system prompt. Prompt Injection, Supply Chain and Improper Output Handling gained scope for content that arrives through documents, images, tool output, memory and MCP servers.
OWASP's guide adds that Prompt Injection now covers cross-modal attacks such as instructions hidden in images or audio, Supply Chain covers promoted model artifacts that are not what they claim to be, Data and Model Poisoning includes subversion of fine-tuning, and Improper Output Handling covers insecure code generated by AI assistants. The Cloud Security Alliance's republication of an analysis by Aembit (October 21, 2026) adds further detail on scope. The OWASP guide is the authority for each entry's exact wording.
OWASP Top 10 for LLM Applications 2026: All 10 Risks Explained
Each risk below follows the same pattern: what it is, what changed, a real case where one is documented, and the first control to put in place. The list is ordered by OWASP's 2026 ranking, not by how likely each risk is for your own application.
LLM01: Prompt Injection
Prompt Injection happens when text, typed by a user or hidden in content the model reads, changes the model's behavior in ways the developer did not intend. In 2026 the scope explicitly covers instructions arriving through documents, images, audio, tool output, persistent memory and MCP server content.
The clearest case is EchoLeak. According to The Hacker News (June 12, 2025), Aim Security found that a crafted email could make Microsoft 365 Copilot leak data from its context without a single click from the user. It was tracked as CVE-2025-32711 with a CVSS score of 9.3. Microsoft fixed it server side.
First control: treat every retrieved document, email and tool result as untrusted input, and inspect it before the model acts on it. OWASP's guide also lists a "Rule of Two", human approval for privileged actions and treating memory writes as privileged.
LLM02: Sensitive Information Disclosure
Sensitive Information Disclosure covers a model or application revealing personal data, credentials or confidential business information. Its 2026 scope extends to tool-call records, logs, embeddings and data derived from fine-tuning, and to retrieval systems that fail to check who is allowed to see what.
EchoLeak is also an example here, because it exfiltrated data the user's Copilot session could access.
First control: detect and mask personal data and secrets in prompts, tool calls and responses, and decide which data classes may reach a model at all.
LLM03: Excessive Agency
Excessive Agency means an application gives a model more tools, permissions or autonomy than the task needs, so a mistaken or manipulated output turns into real damage. It moved from sixth to third in 2026, reflecting the model's growing influence over external systems.
A documented case is the Replit incident. According to eWeek (July 22, 2025), SaaStr founder Jason Lemkin said Replit's AI agent erased a production database holding records on more than 1,200 executives, even though he had told it not to change anything without approval. Replit's CEO called it unacceptable.
First control: give each application only the tools it needs, put limits on each tool, and require confirmation before irreversible actions. OWASP's guide adds that you should avoid open-ended tools, run actions in the user's context, require human approval for high-impact actions and enforce policy outside the LLM.
LLM04: Supply Chain
Supply Chain covers compromised components the application depends on: models, weights, libraries, templates, plugins and MCP servers. The 2026 text adds substituted model weights, promoted model artifacts that are not what they claim to be, unsafe file formats, tampered templates, weak provenance and package names invented by models, known as slopsquatting.
In March 2026 the LiteLLM Python package was hit. According to the LiteLLM security update (March 24, 2026), versions 1.82.7 and 1.82.8 on PyPI contained a credential stealer that harvested environment variables, SSH keys, cloud credentials, Kubernetes tokens and database passwords. The vendor says the packages were live for about 40 minutes.
First control: allow only approved models, packages and servers, pin versions and verify provenance before approval.
LLM05: Data and Model Poisoning
Data and Model Poisoning is the manipulation of training, fine-tuning or retrieval data so the model behaves wrongly or carries a hidden trigger. The 2026 entry covers training, fine-tuning (including its subversion), RAG ingestion and compromised adapters, and separates inference-time injection into LLM01.
Poisoning needs fewer documents than many teams assume. According to Anthropic (October 9, 2025), working with the UK AI Security Institute and The Alan Turing Institute, as few as 250 malicious documents created a backdoor in models from 600 million to 13 billion parameters, regardless of training data size. The backdoor produced gibberish, a narrow case.
First control: validate and track the provenance of training and fine-tuning data, evaluate models before production and monitor what they output.
LLM06: Unbounded Consumption
Unbounded Consumption is excessive, uncontrolled inference that drives up cost, exhausts capacity or lets an attacker copy the model. It rose from tenth to sixth in 2026, and the entry adds denial of wallet, service disruption and model extraction.
We found no verifiable, dated public incident for this entry, so we cite none. The mechanism is clear: an agent that chains tool calls can multiply cost per request, and a leaked API key can turn a pay-per-token endpoint into an open bill.
First control: set token-based rate limits, hard spending caps, request size limits and per-tool execution limits, and plan a fallback if a provider degrades. OWASP's guide also recommends circuit breakers for agents.
LLM07: Misinformation
Misinformation is the model producing false or misleading output that people or systems then act on. It rose from ninth to seventh. According to the Cloud Security Alliance, practitioners ranked it near the bottom in the community vote, while the incident record placed it near the top.
Air Canada's case is the standard reference. According to the American Bar Association (February 2024), a British Columbia tribunal ruled on February 14, 2024 that the airline was responsible for what its chatbot said about bereavement fares, and awarded about CAD 650 plus interest and fees.
First control: ground answers in your own documents with citations, limit the topics an assistant may answer, and add human review where errors are costly. OWASP's guide also separates generation from action (claim, check, then act), so a wrong answer cannot trigger a tool call unchecked.
LLM08: Hidden Context Exposure
Hidden Context Exposure replaces System Prompt Leakage. It covers the disclosure of anything the user was not meant to see: developer instructions, tool schemas, retrieved policy text and workflow criteria, not only the system prompt. It was seventh in 2025 under the old name.
We found no verifiable 2026 incident to cite here. The lesson is unchanged: a determined user can extract anything placed in context, so context is no place for secrets or access rules.
First control: assume hidden context can be discovered, keep credentials and sensitive rules out of prompts, enforce permissions and behavior in code outside the model, and watch for extraction attempts.
LLM09: Vector and Embedding Weaknesses
Vector and Embedding Weaknesses are flaws in how retrieval systems store and fetch data: cross-tenant leakage, retrieval manipulation and the inference of sensitive data from embeddings. It moved from eighth to ninth in 2026 with a refined scope.
The embedding risk is documented in research. A paper presented at EMNLP 2023 (December 2023) showed that a multi-step method could recover 92% of 32-token inputs exactly from their embeddings. Treat a vector store as sensitive data.
First control: enforce per-user permissions in the vector database, separate tenants and validate the documents you index.
LLM10: Improper Output Handling
Improper Output Handling happens when an application uses model output without validating it, so the output reaches a browser, a shell or a database as if it were trusted. It fell from fifth to tenth, but the 2026 entry adds terminal control characters, automatic fetching of external resources, untrusted tool output and insecure code generated by AI assistants.
A 2026 example is CVE-2026-41318. According to OSV (April 24, 2026), AnythingLLM versions before 1.12.1 rendered LLM-generated chart captions without encoding them, which let an attacker who could influence the output, for example through a shared document, run script in other users' browsers. It scored 5.4 (medium) and shows prompt injection becoming stored XSS.
First control: treat model output like any external input. Validate and escape it before displaying, executing or storing it.
How the Ten Risks Group Into Control Types
Most of the ten risks fall into three groups: those you stop at runtime by inspecting and limiting traffic, those you prevent in design and engineering, and those that need both. Knowing the group tells you whether a gateway, a code review or a data process is the right fix.
| Risk | Mainly stopped by |
|---|---|
| LLM01 Prompt Injection | Runtime inspection plus least privilege |
| LLM02 Sensitive Information Disclosure | Runtime data controls plus data classification |
| LLM03 Excessive Agency | Runtime policy and tool restrictions |
| LLM04 Supply Chain | Approval process plus runtime allowlists |
| LLM05 Data and Model Poisoning | Data governance and model evaluation |
| LLM06 Unbounded Consumption | Runtime limits and budgets |
| LLM07 Misinformation | Grounding, review and topic limits |
| LLM08 Hidden Context Exposure | Design (no secrets in prompts) plus extraction detection |
| LLM09 Vector and Embedding Weaknesses | Data-layer access control |
| LLM10 Improper Output Handling | Application code plus output inspection |
Security and Governance: Covering the OWASP LLM Top 10 at Runtime
A runtime control layer sits in the path of AI traffic and covers what passes through it: prompts, responses, tool calls and spend. It cannot see training data, your vector database or your application code, so under this list some risks are covered and others shared.
NeuralTrust's Agent Gateway (TrustGate) decides which models and tools each application can reach, and with what limits. Agent Runtime Security (TrustGuard) inspects content and applies policy to log, block, mask or ask for confirmation. Both work as part of the Runtime Security Mesh.
| Risk | Coverage | How a runtime layer helps | What stays with you |
|---|---|---|---|
| LLM01 Prompt Injection | Covered | Detects jailbreaks and injected instructions in user input, documents, pages and tool results, then logs or blocks | Policy tuning and testing |
| LLM02 Sensitive Information Disclosure | Covered | Detects and masks personal data, secrets and credentials in prompts, tool calls and responses | Deciding which data may reach a model |
| LLM03 Excessive Agency | Covered | Restricts each application to assigned tools and models, with access levels, per-tool limits and block or confirm actions | Reviewing what each agent really needs |
| LLM04 Supply Chain | Shared | Allows only approved models and MCP servers and inspects third-party tool descriptions and results | Verifying provenance and scanning dependencies |
| LLM05 Data and Model Poisoning | Shared | Inspects responses and blocks those outside what is allowed, whatever the cause | Validating training data and evaluating models |
| LLM06 Unbounded Consumption | Covered | Applies rate limits, spend budgets, request size and tool execution limits, plus provider fallback | Choosing the limits |
| LLM07 Misinformation | Shared | Limits the topics an assistant can answer | Checking accuracy in critical cases |
| LLM08 Hidden Context Exposure | Covered | Detects attempts to extract instructions and removes known internal strings from responses | Keeping secrets out of system instructions |
| LLM09 Vector and Embedding Weaknesses | Shared | Calls data sources with the identity of the person asking, inspects retrieved documents and masks personal data | Per-user permissions in the vector database |
| LLM10 Improper Output Handling | Shared | Inspects responses before delivery and can reject or mask flagged values, for non-streamed responses | Validating and escaping output before use |
Five risks are covered at runtime and five are shared. The shared ones show that a gateway complements secure engineering and does not replace it. Our guides on AI agent security and AI vulnerability management cover the parts outside the traffic path.
Where to Start With the OWASP Top 10 for LLM Applications
Start where your exposure is largest. If your application only chats, begin with LLM01, LLM02 and LLM08. If it calls tools, add LLM03 and LLM06 first. If it retrieves company data, add LLM09. If it builds on third-party models or servers, add LLM04.
| If you are | Start with | Why |
|---|---|---|
| Running a customer-facing chatbot | LLM01, LLM02, LLM07 | Untrusted input, personal data and false answers reach customers |
| Building agents that call tools | LLM03, LLM06, LLM01 | Actions and cost grow with each tool and loop |
| Running RAG over internal documents | LLM09, LLM02, LLM05 | Retrieval permissions and data quality decide what leaks |
| Using third-party models, packages or MCP servers | LLM04, LLM03 | A compromised component inherits your access |
| Rendering model output in a web app | LLM10, LLM01 | Injected text can become script in a user's browser |
Whatever you choose, test it. Run adversarial tests against each risk before release and monitor in production. The AIVSS scoring system can rank the findings.
Conclusion
The OWASP Top 10 for LLM applications 2026 keeps the same ten risks and moves the weight toward agents: tool access and runaway cost now rank higher, and hidden context covers more than the system prompt. Use it to threat-model each application, assign every risk an owner and test it before release. Cover what passes through AI traffic at runtime, and fix the rest in data, code and process.
Secure LLM Applications in Production with NeuralTrust
Book a demo to see how NeuralTrust gives you visibility and control over the AI applications and agents your teams build and run.
)
Related reads
- OWASP Top 10 for Agentic Apps 2026
- OWASP MCP Top 10: Every Risk Explained
- What Is Memory and Context Poisoning?
- AI Gateway for Agentic AI: MCP and A2A Security
FAQs about OWASP Top 10 for LLM applications
1. What is the OWASP Top 10 for LLM applications?
It is a ranked list of the ten most critical security risks for applications built on large language models, maintained by the OWASP GenAI Security Project. The 2026 edition was published in August 2026 and runs from LLM01 Prompt Injection to LLM10 Improper Output Handling. It is a threat-modeling guide, not a certification.
2. What changed in the OWASP Top 10 for LLM applications 2026?
No risk was dropped, and eight of the ten positions changed. Excessive Agency rose from sixth to third, Unbounded Consumption from tenth to sixth and Misinformation from ninth to seventh. System Prompt Leakage became Hidden Context Exposure, and several entries gained scope for tool output, memory and MCP content.
3. What is the number one risk in the OWASP LLM Top 10?
Prompt Injection (LLM01) remains first. According to OWASP's 2026 guide, ranking by raw incident counts alone would drop it out of the top ten, which the authors attribute to defenses reducing public exploits, not to lower risk. The Cloud Security Alliance adds that it ranked first in the community vote. It also now covers instructions arriving through documents, images, memory and MCP servers.
4. What is Hidden Context Exposure?
Hidden Context Exposure (LLM08) replaces System Prompt Leakage. It covers the disclosure of anything hidden from the user in the model's context: developer instructions, tool schemas, retrieved policy text and workflow criteria. The lesson is to keep secrets and access rules out of prompts and enforce them in code.
5. What is the difference between the OWASP LLM Top 10 and the Agentic Top 10?
The LLM Top 10 covers risks in any application that uses a language model, including chatbots and RAG systems. The Agentic Top 10 (ASI01 to ASI10) covers agents that plan and act through tools, such as goal hijack and rogue agents. Agent builders should read both, since LLM03 Excessive Agency links the two.
6. How do I protect against the OWASP LLM Top 10?
Combine four layers: restrict what each application can reach, inspect prompts, tool calls and responses at runtime, secure the data and code around the model, and test with adversarial prompts before release. A runtime layer covers part of the list. Training data, vector databases and application code need their own controls.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
- OWASP GenAI Security Project, OWASP Top 10 for LLM Applications 2026, August 2026.
- OWASP GenAI Security Project, 2026 Top 10 for LLM Applications announcement, September 1, 2026.
- Cloud Security Alliance, The OWASP Top 10 for LLM Applications 2026: What Changed and Why It Matters, October 21, 2026.
- The Hacker News, Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data, June 12, 2025.
- eWeek, AI Agent Wipes Production Database, Then Lies About It, July 22, 2025.
- LiteLLM, Security Update: Suspected Supply Chain Incident, March 24, 2026.
- Anthropic, A small number of samples can poison LLMs of any size, October 9, 2025.
- American Bar Association, BC Tribunal Confirms Companies Remain Liable for Information Provided by AI Chatbot, February 2024.
- OSV, CVE-2026-41318 (AnythingLLM), April 24, 2026.
- Morris et al., Text Embeddings Reveal (Almost) As Much As Text, EMNLP, December 2023.
)
)
)
)