OWASP Top 10 for LLM 2026: what changed from 2025

The OWASP Top 10 for LLM Applications 2026 is a free list of the ten biggest security risks in apps built on large language models (LLMs). OWASP published version 1.0 in August 2026, and it moves more entries than past editions did.

This post compares the two lists, explains each change in plain words, and ends with a checklist you can run on your own chatbot, RAG app or agent project.

What is the OWASP Top 10 for LLM Applications?

The OWASP Top 10 for LLM Applications is a ranked list of security risks, written by a volunteer community under the OWASP Gen AI Security Project. OWASP (Open Worldwide Application Security Project) is the group behind the well-known web security Top 10. Each entry explains the risk, gives example scenarios and lists ways to reduce it.

The 2026 document is 122 pages long and free to download. It is licensed under Creative Commons CC BY-SA 4.0, so you can share and adapt it with credit.

OWASP LLM Top 10 2025 vs 2026: the full list

Here is each 2026 rank, with the 2025 rank in brackets.

1. 1Prompt Injection (was 1st, no change)
2. 2Sensitive Information Disclosure (was 2nd, no change)
3. 3Excessive Agency (was 6th, up 3 places)
4. 4Supply Chain (was 3rd, down 1)
5. 5Data and Model Poisoning (was 4th, down 1)
6. 6Unbounded Consumption (was 10th, up 4)
7. 7Misinformation (was 9th, up 2)
8. 8Hidden Context Exposure (new name for System Prompt Leakage, was 7th)
9. 9Vector and Embedding Weaknesses (was 8th, down 1)
10. 10Improper Output Handling (was 5th, down 5)

The codes follow the ranks, so LLM03:2026 is Excessive Agency, while LLM03:2025 was Supply Chain. Check the year when you read a code in a paper or blog.

Why did Excessive Agency move to 3rd?

Excessive Agency moved to 3rd because, in the words of the 2026 document, "agentic deployments are where the damage is landing". OWASP calls it the most important move on the list.

Excessive Agency means an LLM can take harmful actions through the tools it is given, such as sending email, deleting files or calling an API. The cause can be a hallucination, a badly written prompt, or a prompt injection hidden in a web page or a tool result. If you build agents, read our simple guide to AI agents first.

Why did Unbounded Consumption rise 4 places?

Unbounded Consumption rose from 10th to 6th because practitioners now rate cost and resource abuse as a bigger risk. The risk is that someone makes your app run huge amounts of computation, which can crash the service or produce a large bill.

The 2026 entry names newer reasons: reasoning models with large output budgets, multimodal requests that cost more, and agents or tool protocols such as MCP that turn one request into many downstream calls. For a student on a free or prepaid API key, this is the risk most likely to hurt you first.

What is Hidden Context Exposure?

Hidden Context Exposure is the 2026 name for what was called System Prompt Leakage in 2025. OWASP defines it as the unauthorized extraction, inference or reconstruction of hidden instructions or context placed in a model's context.

The new name is broader. It covers any hidden context, not only the system prompt. The risk becomes serious when that hidden text holds secrets, policy logic, tool details or other information that helps an attacker. The plain lesson: never put API keys or passwords in a prompt, and assume a user can read anything the model can see.

Does Improper Output Handling matter less now?

Improper Output Handling fell furthest, from 5th to 10th, but it still matters. The entry means passing model output to another system, such as a web page, database, shell or file path, without checking it first.

The entry also grew in 2026. It now covers the insecure code that AI coding assistants produce at scale. OWASP's own advice is to "work all ten", so a lower rank does not mean you can skip it.

What else grew inside the 2026 entries?

OWASP chose to fold newer risks into existing entries rather than add thin new categories. The document lists four:

• Prompt Injection: now covers cross-modal attacks, where instructions hide inside an image or audio.
• Supply Chain: now covers a promoted model file that is not what it claims to be.
• Data and Model Poisoning: now includes fine-tuning subversion.
• Output Handling: now spans insecure AI-generated code.

The 2026 list also draws a clear line. It covers the model as a component inside your app. Once the model acts on its own with tools and memory, OWASP says to pair this list with the separate OWASP Top 10 for Agentic Applications.

OWASP LLM Top 10 checklist for student projects

Use this short checklist before you demo or deploy an LLM project. It maps to the 2026 ranks.

• Untrusted input: treat user text, uploaded files, images and retrieved pages as untrusted (LLM01).
• No secrets in context: keep keys, passwords and private data out of prompts and RAG documents (LLM02, LLM08).
• Least agency: give an agent only the tools it needs, read-only where possible, and ask a human before any action that sends, deletes or pays (LLM03).
• Pinned dependencies: download models and packages from trusted sources and pin exact versions (LLM04).
• Clean data: record where fine-tuning and RAG data came from (LLM05).
• Spending limits: set a monthly budget cap on your API key, plus rate limits and maximum output tokens (LLM06).
• Check claims: show sources for answers and verify any package name a model suggests before you install it (LLM07).
• Access rules in RAG: a user should only retrieve documents they are allowed to see (LLM09).
• Escape output: treat model output like user input before it reaches HTML, SQL, a shell or a file path, and review AI-written code (LLM10).

Our view: three mistakes are easy to make in a student project, which are secrets in prompts, no spending cap, and agents with too many tools. Fix those first. For testing your safety layer, see our guide to AI guardrails and red teaming.

How to read the 2026 document

1. 1Read pages 5 to 7, "What's New in the 2026 Top 10", for the reasons behind each move.
2. 2Pick the three entries that match your project, for example LLM01, LLM03 and LLM06 for an agent.
3. 3For each entry, read the prevention list and tick off what your project already does.
4. 4Write the gaps in your README as "known limitations".

LLM security is a young field with many open research questions, such as how to measure Excessive Agency or detect cross-modal injection. If you want to study it with other students, join APJ-RAISE. It is free.