# OWASP Top 10 for LLM applications

> The OWASP Top 10 for LLM applications lists the ten biggest risks in apps built on language models. The 2026 edition reorders the 2025 list and renames one entry.

Source: https://www.honeyhive.ai/learn/owasp-llm-top-10 (updated 2026-11-02)

The OWASP Top 10 for LLM applications is a ranked list of the ten most critical security risks in software built on large language models. The [OWASP GenAI Security Project](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10) maintains it, and its current release is the 2026 edition, published August 4, 2026. That release [updates the ordering, scope, examples, mitigations, and framework mappings](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10) of the 2025 list.

## The 2026 list next to the 2025 list

The [2025 edition](https://genai.owasp.org/llm-top-10/) listed prompt injection first and unbounded consumption last. The [2026 list](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10) is below, with the 2025 position of each entry from [OWASP's 2025 page](https://genai.owasp.org/llm-top-10/).

| 2026 | Entry | 2025 | Move |
|---|---|---|---|
| LLM01 | Prompt Injection | LLM01 | Same |
| LLM02 | Sensitive Information Disclosure | LLM02 | Same |
| LLM03 | Excessive Agency | LLM06 | Up 3 |
| LLM04 | Supply Chain | LLM03 | Down 1 |
| LLM05 | Data and Model Poisoning | LLM04 | Down 1 |
| LLM06 | Unbounded Consumption | LLM10 | Up 4 |
| LLM07 | Misinformation | LLM09 | Up 2 |
| LLM08 | Hidden Context Exposure | LLM07 (System Prompt Leakage) | Down 1, renamed |
| LLM09 | Vector and Embedding Weaknesses | LLM08 | Down 1 |
| LLM10 | Improper Output Handling | LLM05 | Down 5 |

No entry was added or dropped. OWASP's letter from the project leads [says](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM00_Preface.md) newer risks were folded into entries that already own them: cross-modal prompt injection (instructions hidden in an image or audio track), model artifacts that are not what they claim to be under supply chain, fine-tuning subversion under poisoning, and insecure code that assistants generate under improper output handling.

## How the 2026 ranking was built

For the first time, OWASP tested the practitioner vote against incident data. Its [preface](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM00_Preface.md) says the team collected 7,714 incidents from public vulnerability databases and an AI-harm database, and sorted the 6,639 with enough detail. The community vote carries three-quarters of the weight and the incident data one quarter.

The two disagreed in places. Prompt injection ranks first by vote but falls out of the top 10 by raw incident count, which OWASP attributes to a defense effect: teams fight it hard, so fewer clean exploits reach public databases. Misinformation went the other way, near the bottom by vote and near the top by incidents, and the list seats it in the middle.

## The ten risks

| Entry | What it covers | Source |
|---|---|---|
| LLM01 Prompt Injection | Input that changes model behavior in ways the developer did not intend. See [prompt injection](/learn/prompt-injection). | [OWASP](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM01_PromptInjection.md) |
| LLM02 Sensitive Information Disclosure | Exposure of confidential or regulated data through any channel, including tool-call arguments, reasoning traces, retrieved chunks, logs and embeddings. | [OWASP](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM02_SensitiveInformationDisclosure.md) |
| LLM03 Excessive Agency | Damaging actions taken on unexpected, ambiguous or manipulated model output. Root causes are excessive functionality, permissions or autonomy. | [OWASP](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM03_ExcessiveAgency.md) |
| LLM04 Supply Chain | Tampered or replaced models, datasets, adapters, conversion pipelines and deployment platforms. | [OWASP](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM04_SupplyChain.md) |
| LLM05 Data and Model Poisoning | Manipulated data or model artifacts that embed harmful behavior, at pre-training, fine-tuning, embedding, retrieval or distribution. | [OWASP](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM05_DataModelPoisoning.md) |
| LLM06 Unbounded Consumption | Uncontrolled inference that causes outages, runaway cost or model cloning. | [OWASP](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM06_UnboundedConsumption.md) |
| LLM07 Misinformation | Incorrect or unsupported output that is trusted and acted on by a person, workflow or agent. | [OWASP](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM07_Misinformation.md) |
| LLM08 Hidden Context Exposure | Extraction, inference or reconstruction of the system prompt, retrieved policy text, tool schemas and other context the user is not meant to see. | [OWASP](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM08_HiddenContextExposure.md) |
| LLM09 Vector and Embedding Weaknesses | Risks in any app that uses embeddings and similarity search, such as RAG, agent memory and semantic caches. | [OWASP](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM09_VectorAndEmbeddingWeaknesses.md) |
| LLM10 Improper Output Handling | Model output passed downstream without validation or sanitization, which can lead to XSS, CSRF, SSRF, privilege escalation or remote code execution. | [OWASP](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM10_ImproperOutputHandling.md) |

## Entries that changed in meaning

**Excessive Agency** is the move OWASP calls the most consequential. [OWASP says](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM03_ExcessiveAgency.md) it enables damaging actions whatever causes the model to misbehave, whether hallucination or injection. Its first mitigations are to minimize the tools an agent can call, minimize what each tool can do, and avoid open-ended tools. For how agents are built, see [what AI agents are](/learn/what-are-ai-agents).

**Unbounded Consumption** is now framed as a cost problem as much as an availability one. [OWASP writes](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM06_UnboundedConsumption.md) that request-rate limiting alone is no longer sufficient and that defense needs token-aware cost controls, hard spending caps, agent-level circuit breakers and continuous cost-attribution monitoring.

**Hidden Context Exposure** replaces System Prompt Leakage. [OWASP advises](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM08_HiddenContextExposure.md) designing on the assumption that hidden context is discoverable, keeping credentials out of it, and not relying on it alone as a security boundary for authorization, policy enforcement or content filtering.

**Improper Output Handling** fell to tenth, but [OWASP's entry](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM10_ImproperOutputHandling.md) still lists missing context-specific output encoding and insufficient logging of model outputs among the conditions that raise impact.

## What the list does not cover

The [2026 preface](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM00_Preface.md) draws a boundary. The LLM list owns the risk when the model is a component inside your application. Once the model has tools, memory between sessions and downstream consequences, the risk moves to the OWASP Agentic Top 10. Several LLM entries point there: [supply-chain risks from MCP servers and tool registries](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM04_SupplyChain.md) are covered by the Agentic list's ASI04. See the [Model Context Protocol](/learn/model-context-protocol) for how those tools attach.

## Using the list

OWASP's stated posture is to [build the system around the model](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM00_Preface.md) so that when the model is fooled, nothing important breaks. In practice, that means working through the table as a threat-modeling checklist:

- Put runtime checks on inputs and outputs. See [AI guardrails](/learn/ai-guardrails).
- Test each entry adversarially before launch. See [AI red teaming](/learn/ai-red-teaming).
- Keep records of what the model, its tools and its retrieval steps did, so you can see attempts and incidents afterward.

## Watching these risks in production with HoneyHive

Several entries are about what happens at runtime: LLM06 asks for continuous cost-attribution monitoring, and LLM03 and LLM10 depend on seeing which tools were called and what output was passed on. Tracing records those steps (see [agent observability](/learn/agent-observability)). HoneyHive [alerts](https://docs.honeyhive.ai/v2/monitoring/alerts/alerts_overview.md) monitor cost, latency, error rates and evaluator scores, and [online evaluations](https://docs.honeyhive.ai/v2/monitoring/onlineevals.md) score production traces with code or LLM judges, and each evaluated trace shows its scores next to its inputs and outputs.

Traces are also a disclosure surface. OWASP's LLM02 entry [notes](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM02_SensitiveInformationDisclosure.md) that observability platforms log full prompts, completions and traces by default, and recommends scrubbing logs and traces before ingestion. HoneyHive traces hold the same data, so the advice applies to it as much as to any other tool.

## FAQ

### What is the OWASP Top 10 for LLM applications?

It is a community-written list of the ten most critical security risks in applications built on large language models, kept by the OWASP GenAI Security Project. The [current edition](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10) was published August 4, 2026.

### What changed between the 2025 and 2026 lists?

Per the [OWASP preface](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM00_Preface.md), Excessive Agency moved up to third, Unbounded Consumption rose four places, Improper Output Handling fell from fifth to tenth, and System Prompt Leakage became Hidden Context Exposure. Prompt Injection stayed first.

### Is the OWASP LLM Top 10 the same as the OWASP Agentic Top 10?

No. The [2026 preface](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM00_Preface.md) says the LLM list covers the model as a component in your application. When the model becomes an actor with tools, memory and downstream consequences, the risk moves to the Agentic list.