The short answer
The OWASP LLM Top 10, formally the OWASP Top 10 for LLM Applications, lists the ten most critical security risks in software built on large language models. The OWASP GenAI Security Project published the 2026 edition in August 2026: prompt injection stays first (LLM01) and excessive agency rises to third. Testers use it to structure AI red teaming.
On this page
The OWASP LLM Top 10, formally the OWASP Top 10 for LLM Applications, is a ranked list of the ten most critical security risks in applications built on large language models. It is published by the OWASP GenAI Security Project, and the current edition is 2026, released in August 2026. It gives developers, buyers and testers one set of names for how AI features fail, from prompt injection to unsafe handling of model output.
What is the OWASP Top 10 for LLM applications?
It is the AI counterpart of the OWASP Top 10 for web applications and, like it, an awareness document rather than a certifiable standard. Its scope is the whole LLM application: the model, its prompts, the documents it retrieves, the tools it calls and the code that uses its output. Most of the risks live in that surrounding design rather than in the model’s weights.
Version 1.0 was published in 2023. The 2025 edition, released in late 2024, reworked the list for retrieval-augmented generation (RAG) and agents that take actions. The 2026 edition, published on 3 August 2026, keeps the same ten risks but reorders them around agents that act, and its ranking combines a practitioner vote with evidence from real-world incidents. A separate OWASP Top 10 for Agentic Applications for 2026, published on 9 December 2025, complements it for autonomous agents.
What are the risks in the OWASP LLM Top 10 2026?
| ID | Risk | What it means |
|---|---|---|
| LLM01 | Prompt Injection | Instructions in user input, or hidden in documents, web pages, tool output, images, audio or memory, change the model’s behaviour; see prompt injection |
| LLM02 | Sensitive Information Disclosure | The model, its logs or its tool calls reveal personal data, credentials, business data or records the user should not see |
| LLM03 | Excessive Agency | A model given more tools, permissions or autonomy than it needs does real damage when it is wrong or manipulated; see agentic AI security |
| LLM04 | Supply Chain | Vulnerable or tampered third-party models, datasets, adapters, plugins or model repositories |
| LLM05 | Data and Model Poisoning | Training, fine-tuning or retrieval data manipulated to plant bias, backdoors or false answers |
| LLM06 | Unbounded Consumption | Uncontrolled requests, agent loops or costly reasoning that exhaust resources, run up bills or let an attacker copy the model’s behaviour |
| LLM07 | Misinformation | Confident but false output, including invented facts, code packages or citations, relied on by people or automated processes |
| LLM08 | Hidden Context Exposure | System prompts, tool definitions, policy text and other hidden context extracted from the model; replaces System Prompt Leakage |
| LLM09 | Vector and Embedding Weaknesses | Flaws in RAG pipelines, vector stores and semantic caches, such as cross-tenant leakage or manipulated retrieval |
| LLM10 | Improper Output Handling | Model output passed unchecked to browsers, databases, shells or terminals, leading to XSS, injection or code execution |
What is the number one LLM risk?
Prompt injection, which has been LLM01 in every edition. A language model cannot reliably tell instructions apart from the data it processes, so an email, web page or PDF it reads can carry instructions of its own. OWASP acknowledges there may be no foolproof prevention, so defences focus on limiting what an injected model can reach and do, which ties LLM01 closely to excessive agency (LLM03). The 2026 edition also notes that so much effort goes into blocking prompt injection that it may look rarer in incident data than it really is.
What changed in the 2026 edition?
No risks were added or removed. The 2026 edition reorders the 2025 list, renames one entry and widens several. Every 2025 entry moved as follows:
| 2025 entry | 2026 entry | What changed |
|---|---|---|
| LLM01 Prompt Injection | LLM01 Prompt Injection | Still first; now spells out attacks through images, audio, tool output and persistent memory |
| LLM02 Sensitive Information Disclosure | LLM02 Sensitive Information Disclosure | Same place |
| LLM03 Supply Chain | LLM04 Supply Chain | Down one |
| LLM04 Data and Model Poisoning | LLM05 Data and Model Poisoning | Down one; now includes subverting fine-tuning |
| LLM05 Improper Output Handling | LLM10 Improper Output Handling | Down five, with a wider scope |
| LLM06 Excessive Agency | LLM03 Excessive Agency | Up three, as more applications let models call tools and act |
| LLM07 System Prompt Leakage | LLM08 Hidden Context Exposure | Renamed and widened beyond the system prompt |
| LLM08 Vector and Embedding Weaknesses | LLM09 Vector and Embedding Weaknesses | Down one |
| LLM09 Misinformation | LLM07 Misinformation | Up two |
| LLM10 Unbounded Consumption | LLM06 Unbounded Consumption | Up four |
Because the numbers moved, an ID on its own is ambiguous: LLM06 meant excessive agency in 2025 and means unbounded consumption in 2026. Quote the edition year with every ID in reports, policies and contracts.
The previous change, from 2023 to 2025, added System Prompt Leakage and Vector and Embedding Weaknesses, widened Model Denial of Service into Unbounded Consumption, folded Insecure Plugin Design into Excessive Agency and Model Theft into Unbounded Consumption, and renamed Overreliance as Misinformation.
How is the LLM Top 10 used in LLM security testing?
In LLM security testing and AI red teaming, the list is the coverage map: each risk is tried against your feature and every finding is mapped to one or more IDs. A single attack often spans several: an indirect prompt injection through a shared document (LLM01) that makes an agent email out customer records (LLM03) is also a data disclosure (LLM02).
| Risk (2026) | What a tester checks |
|---|---|
| LLM01 Prompt Injection | Direct overrides in chat, and instructions planted in documents, pages, emails, images and tool results the model reads |
| LLM02 Sensitive Information Disclosure | Whether answers, logs or retrieval return other users’ data, secrets or personal data |
| LLM03 Excessive Agency | Which tools and permissions the model holds, and whether a manipulated model can use them without a human check |
| LLM04 Supply Chain | Where models, adapters, plugins and datasets come from, and whether versions are pinned and verified |
| LLM05 Data and Model Poisoning | Who can add content to training, fine-tuning or retrieval sources, and what it takes to plant a false answer |
| LLM06 Unbounded Consumption | Rate limits, quotas, timeouts and cost controls, including runaway agent loops |
| LLM07 Misinformation | Whether answers that drive decisions or code are checked, and how invented packages or citations are caught |
| LLM08 Hidden Context Exposure | Whether system prompts, tool definitions and policy text can be extracted, and whether they hold anything secret |
| LLM09 Vector and Embedding Weaknesses | Tenant separation and access control in vector stores and semantic caches |
| LLM10 Improper Output Handling | Whether model output is validated and encoded before it reaches browsers, databases, shells or other systems |
- Scope follows connections. The more data and tools a model can reach, the more LLM02, LLM03 and LLM09 matter. Tool connectors such as Model Context Protocol servers are covered in our MCP security guide.
- The surrounding application still counts. Login, access control and APIs are tested against the standard OWASP Top 10.
- Coverage is reported, not just findings. A good report shows which LLM risks were tested and found clear, with the edition named, which is the evidence customers and auditors ask for.
Why Sovereign Secure?
Sovereign Secure tests AI and LLM applications alongside web, API, cloud and network testing, so the model and the application around it can be scoped into one engagement. We are a PCI SSC-approved QSA company and ISO 27001 certified, which matters when testers handle your prompts, data and system documentation.
To have an AI feature tested against the OWASP LLM Top 10, request a testing quote, or return to the cyber security glossary.
Your next step
- Scope your testChoose your test types and asset counts online to scope your penetration test.Scope your test
- Pen testing cost guideUK day rates, price ranges by test type and what drives the cost.Read the cost guide
- Talk to a testerTell us what you need tested. We aim to reply within one working day.Talk to a tester
Last reviewed October 2026 by the Sovereign Secure assessment team.
