OWASP Top 10 for LLM Applications

This content was generated with the assistance of AI and should be verified against the official documentation of each tool and framework before being relied on in production.

This section’s bibliography lists the reference material consulted while preparing these pages.

Written on 2026-10-01 against the OWASP Top 10 for LLM Applications 2026 edition. The OWASP GenAI Security Project resource page shows 2026-08-03 as its publication date and the source repository’s README states 2026-08-04, so it is cited here as August 2026; the 2025 edition is kept in the repository’s 2025/ directory and the 2023 v1.1 edition is the one the book The Developer’s Playbook for Large Language Model Security (Wilson) is written against. The LLM Top 10 index page on the OWASP site may still present the 2025 edition, so link to the resource pages in the references rather than the index. The short names below were read from the sources on the date above; the descriptions are paraphrased summaries, not OWASP text. See the version baseline for the other frameworks.

The list ranks the risks the OWASP community judged most critical for applications built on LLMs. It is an awareness document, not a standard and not a complete threat model: use it as a shared vocabulary and a review checklist, and pair it with the threat model from Trust Boundaries and Threat Modeling.

The 2026 list

ID Risk Summary (paraphrased) Treated on

LLM01

Prompt Injection

Text that the model reads, from a user directly or from a document, web page or tool result indirectly, changes its behaviour against the developer’s intent. Because instructions and data share one channel, it cannot be fully eliminated, only contained by layers.

Prompt Injection

LLM02

Sensitive Information Disclosure

The application reveals personal data, credentials, proprietary documents or training content to someone who should not see it, through the model’s output or through over-broad retrieval.

Sensitive Information and Hidden Context

LLM03

Excessive Agency

The model is given more functions, permissions or autonomy than the task needs, so a wrong or manipulated decision becomes a harmful action.

Excessive Agency and Tool Security

LLM04

Supply Chain

Models, datasets, adapters, libraries, plugins and servers obtained from third parties are tampered with, malicious or simply unverified.

Supply Chain Security

LLM05

Data and Model Poisoning

Training, fine-tuning, embedding or ingestion data is manipulated to plant backdoors, bias or false content that later surfaces in answers.

RAG and Vector Security

LLM06

Unbounded Consumption

Uncontrolled use of tokens, compute or calls leads to outages, runaway cost (denial of wallet) or model extraction.

Unbounded Consumption and Denial of Wallet

LLM07

Misinformation

The model produces confident but false or unsupported output that users or downstream systems rely on, with legal, safety or reputational consequences.

Misinformation and Hallucination Risk

LLM08

Hidden Context Exposure

Content the developer meant to keep out of users' sight, such as system prompts, tool schemas, memory and other injected context, is extracted, and any secret placed there is lost. It replaces the 2025 entry named System Prompt Leakage.

Sensitive Information and Hidden Context

LLM09

Vector and Embedding Weaknesses

Weak access control, tenant mixing, poisoning or inversion in the vector store and embedding pipeline of a RAG system.

RAG and Vector Security

LLM10

Improper Output Handling

Model output is passed to browsers, interpreters, databases or other systems without the validation that any untrusted input would receive.

Improper Output Handling

From 2023 to 2025 to 2026

Teams and books refer to different editions, so a finding labelled "LLM02" can mean three different things. The table maps the risks across editions. Where an entry was merged, split or renamed the cell says so; treat the mapping as guidance for translating labels, not as an exact equivalence, because the editions regrouped risks rather than renumbering them. The 2023 (v1.1) and 2025 names were checked on 2026-10-01 against the official 2023-24 list and 2025 list.

2023 (v1.1) 2025 2026

LLM01 Prompt Injection

LLM01 Prompt Injection

LLM01 Prompt Injection

LLM06 Sensitive Information Disclosure

LLM02 Sensitive Information Disclosure

LLM02 Sensitive Information Disclosure

LLM05 Supply Chain Vulnerabilities

LLM03 Supply Chain

LLM04 Supply Chain

LLM03 Training Data Poisoning

LLM04 Data and Model Poisoning

LLM05 Data and Model Poisoning

LLM02 Insecure Output Handling

LLM05 Improper Output Handling

LLM10 Improper Output Handling

LLM08 Excessive Agency (with LLM07 Insecure Plugin Design)

LLM06 Excessive Agency

LLM03 Excessive Agency

(no entry; part of prompt injection and disclosure discussions)

LLM07 System Prompt Leakage

LLM08 Hidden Context Exposure

(no entry)

LLM08 Vector and Embedding Weaknesses

LLM09 Vector and Embedding Weaknesses

LLM09 Overreliance

LLM09 Misinformation

LLM07 Misinformation

LLM04 Model Denial of Service (with LLM10 Model Theft)

LLM10 Unbounded Consumption

LLM06 Unbounded Consumption

Three practical points follow from the table. First, the 2023 "Insecure Plugin Design" concern did not disappear: it is absorbed into excessive agency and supply chain, and it is why the tool and MCP guidance lives on its own page. Second, the 2025 entry for system prompt leakage was widened in 2026 to cover everything hidden in the context, which is a reminder that the right design goal is no secrets in the prompt rather than a prompt that resists extraction. Third, when you read a book or a vendor report, check its edition before copying an identifier into your own register.

Using the list in design reviews

A design review of an LLM feature does not need all ten risks every time; it needs the right questions asked of the diagram. A workable routine for the DocsAssistant follows.

  1. Start from the diagram, not the list. List every place text from outside enters the context and every action the model can trigger. Those two inventories point to LLM01, LLM03 and LLM10 immediately.

  2. Add the data stores. Each store of documents or embeddings raises LLM02, LLM05 and LLM09; each hosted model, dataset or server raises LLM04.

  3. Add the economics and the users. A public endpoint raises LLM06; any user-facing factual claim raises LLM07; any prompt containing something confidential raises LLM08.

  4. For each applicable risk record a control, a test and an owner in the threat register, using the Attack, Defend, Test and Map structure of the risk pages.

  5. Re-review on change. New tools, new document sources, new channels or a new model version reopen the list.

  6. Report in several vocabularies. The same finding carries its OWASP LLM ID, its Agentic ASI ID where the system is an agent, its MITRE ATLAS technique and its NIST AI 600-1 risk, so it can be filed in whichever process the organisation uses.

The list also has limits worth stating in a review: it says nothing about fairness, accessibility, intellectual property or regulation (see Responsible AI Practices and EU AI Act), and it is silent on classic web risks, which still apply to every endpoint around the model.

References