OWASP Top 10 for LLM applications

The OWASP Top 10 for LLM applications is a ranked list of the ten most critical security risks in software built on large language models. The OWASP GenAI Security Project maintains it, and its current release is the 2026 edition, published August 4, 2026. That release updates the ordering, scope, examples, mitigations, and framework mappings of the 2025 list.

The 2026 list next to the 2025 list

The 2025 edition listed prompt injection first and unbounded consumption last. The 2026 list is below, with the 2025 position of each entry from OWASP’s 2025 page.

2026	Entry	2025	Move
LLM01	Prompt Injection	LLM01	Same
LLM02	Sensitive Information Disclosure	LLM02	Same
LLM03	Excessive Agency	LLM06	Up 3
LLM04	Supply Chain	LLM03	Down 1
LLM05	Data and Model Poisoning	LLM04	Down 1
LLM06	Unbounded Consumption	LLM10	Up 4
LLM07	Misinformation	LLM09	Up 2
LLM08	Hidden Context Exposure	LLM07 (System Prompt Leakage)	Down 1, renamed
LLM09	Vector and Embedding Weaknesses	LLM08	Down 1
LLM10	Improper Output Handling	LLM05	Down 5

No entry was added or dropped. OWASP’s letter from the project leads says newer risks were folded into entries that already own them: cross-modal prompt injection (instructions hidden in an image or audio track), model artifacts that are not what they claim to be under supply chain, fine-tuning subversion under poisoning, and insecure code that assistants generate under improper output handling.

How the 2026 ranking was built

For the first time, OWASP tested the practitioner vote against incident data. Its preface says the team collected 7,714 incidents from public vulnerability databases and an AI-harm database, and sorted the 6,639 with enough detail. The community vote carries three-quarters of the weight and the incident data one quarter.

The two disagreed in places. Prompt injection ranks first by vote but falls out of the top 10 by raw incident count, which OWASP attributes to a defense effect: teams fight it hard, so fewer clean exploits reach public databases. Misinformation went the other way, near the bottom by vote and near the top by incidents, and the list seats it in the middle.

The ten risks

Entry	What it covers	Source
LLM01 Prompt Injection	Input that changes model behavior in ways the developer did not intend. See prompt injection.	OWASP
LLM02 Sensitive Information Disclosure	Exposure of confidential or regulated data through any channel, including tool-call arguments, reasoning traces, retrieved chunks, logs and embeddings.	OWASP
LLM03 Excessive Agency	Damaging actions taken on unexpected, ambiguous or manipulated model output. Root causes are excessive functionality, permissions or autonomy.	OWASP
LLM04 Supply Chain	Tampered or replaced models, datasets, adapters, conversion pipelines and deployment platforms.	OWASP
LLM05 Data and Model Poisoning	Manipulated data or model artifacts that embed harmful behavior, at pre-training, fine-tuning, embedding, retrieval or distribution.	OWASP
LLM06 Unbounded Consumption	Uncontrolled inference that causes outages, runaway cost or model cloning.	OWASP
LLM07 Misinformation	Incorrect or unsupported output that is trusted and acted on by a person, workflow or agent.	OWASP
LLM08 Hidden Context Exposure	Extraction, inference or reconstruction of the system prompt, retrieved policy text, tool schemas and other context the user is not meant to see.	OWASP
LLM09 Vector and Embedding Weaknesses	Risks in any app that uses embeddings and similarity search, such as RAG, agent memory and semantic caches.	OWASP
LLM10 Improper Output Handling	Model output passed downstream without validation or sanitization, which can lead to XSS, CSRF, SSRF, privilege escalation or remote code execution.	OWASP

Entries that changed in meaning

Excessive Agency is the move OWASP calls the most consequential. OWASP says it enables damaging actions whatever causes the model to misbehave, whether hallucination or injection. Its first mitigations are to minimize the tools an agent can call, minimize what each tool can do, and avoid open-ended tools. For how agents are built, see what AI agents are.

Unbounded Consumption is now framed as a cost problem as much as an availability one. OWASP writes that request-rate limiting alone is no longer sufficient and that defense needs token-aware cost controls, hard spending caps, agent-level circuit breakers and continuous cost-attribution monitoring.

Hidden Context Exposure replaces System Prompt Leakage. OWASP advises designing on the assumption that hidden context is discoverable, keeping credentials out of it, and not relying on it alone as a security boundary for authorization, policy enforcement or content filtering.

Improper Output Handling fell to tenth, but OWASP’s entry still lists missing context-specific output encoding and insufficient logging of model outputs among the conditions that raise impact.

What the list does not cover

The 2026 preface draws a boundary. The LLM list owns the risk when the model is a component inside your application. Once the model has tools, memory between sessions and downstream consequences, the risk moves to the OWASP Agentic Top 10. Several LLM entries point there: supply-chain risks from MCP servers and tool registries are covered by the Agentic list’s ASI04. See the Model Context Protocol for how those tools attach.

Using the list

OWASP’s stated posture is to build the system around the model so that when the model is fooled, nothing important breaks. In practice, that means working through the table as a threat-modeling checklist:

• Put runtime checks on inputs and outputs. See AI guardrails.
• Test each entry adversarially before launch. See AI red teaming.
• Keep records of what the model, its tools and its retrieval steps did, so you can see attempts and incidents afterward.

Watching these risks in production with HoneyHive

Several entries are about what happens at runtime: LLM06 asks for continuous cost-attribution monitoring, and LLM03 and LLM10 depend on seeing which tools were called and what output was passed on. Tracing records those steps (see agent observability). HoneyHive alerts monitor cost, latency, error rates and evaluator scores, and online evaluations score production traces with code or LLM judges, and each evaluated trace shows its scores next to its inputs and outputs.

Traces are also a disclosure surface. OWASP’s LLM02 entry notes that observability platforms log full prompts, completions and traces by default, and recommends scrubbing logs and traces before ingestion. HoneyHive traces hold the same data, so the advice applies to it as much as to any other tool.

FAQ

What is the OWASP Top 10 for LLM applications?

It is a community-written list of the ten most critical security risks in applications built on large language models, kept by the OWASP GenAI Security Project. The current edition was published August 4, 2026.

What changed between the 2025 and 2026 lists?

Per the OWASP preface, Excessive Agency moved up to third, Unbounded Consumption rose four places, Improper Output Handling fell from fifth to tenth, and System Prompt Leakage became Hidden Context Exposure. Prompt Injection stayed first.

Is the OWASP LLM Top 10 the same as the OWASP Agentic Top 10?

No. The 2026 preface says the LLM list covers the model as a component in your application. When the model becomes an actor with tools, memory and downstream consequences, the risk moves to the Agentic list.