What is the OWASP Top 10 for LLM Applications?

The OWASP Top 10 for LLM Applications is a security awareness document identifying the most critical vulnerabilities in applications that use Large Language Models. The 2026 edition, published in August 2026, covers prompt injection, sensitive information disclosure, excessive agency, supply chain risk, data and model poisoning, unbounded consumption, misinformation, hidden context exposure, vector and embedding weaknesses, and improper output handling.

What is prompt injection in LLM applications?

Prompt injection is an attack where a malicious user crafts input that overrides or manipulates the LLM system prompt, causing the model to perform unintended actions such as leaking system instructions, bypassing safety filters, or executing unauthorized operations.

How can organizations secure LLM-powered applications?

Organizations should implement input validation and sanitization, enforce strict output handling, use privilege separation so LLMs operate with least privilege, monitor for anomalous behavior, maintain human-in-the-loop for sensitive operations, and regularly audit training data and model supply chains.

OWASP Top 10 for LLM Applications

By FixTheVuln Team Peer-reviewed security content Sources: CISA, NVD, OWASP

Test Your Knowledge

Security+ Practice Quiz CISSP Practice Quiz

← Back to Home

Key Takeaways

The 2026 edition ranks the list using practitioner votes weighed against real incident records: eight of the ten categories moved position
Prompt injection (LLM01) holds the top spot, so treat all user input to LLMs as untrusted
Sensitive information disclosure (LLM02) stays at number two: LLMs can leak training data, context, and PII
Excessive agency jumped from sixth to third (LLM03) as both the practitioner vote and the incident record pointed to agentic deployments
System Prompt Leakage was broadened and renamed Hidden Context Exposure (LLM08): it now covers any hidden, non-user-facing instructions or operational context placed in a model's context, not only the system prompt
Improper Output Handling fell from fifth to tenth (LLM10), but the severity of what it causes (XSS, SSRF, RCE) has not changed
Maintain an AI Bill of Materials (AI-BOM) to track models, datasets, and plugins in your supply chain

Securing LLM-Powered Applications

Large Language Models are being integrated into applications at an unprecedented rate, from chatbots and code assistants to autonomous agents. The OWASP Top 10 for LLM Applications (2026 edition, published in August 2026) identifies the most critical security risks unique to these systems. Unlike traditional web vulnerabilities, LLM risks stem from the probabilistic nature of model outputs, the opacity of training data, and the novel ways users interact with AI systems.

The biggest moves: Excessive Agency climbed from sixth to third and Unbounded Consumption rose four places, while Improper Output Handling fell furthest, from fifth to tenth. Misinformation rose two places after the incident data ranked it far higher than practitioners did.

Each of the ten categories below has its own detailed page with risk ratings, real-world attack examples, and practical mitigations. Click through from the summary grid.

LLM01: Prompt Injection Critical LLM02: Sensitive Information Disclosure Critical LLM03: Excessive Agency Critical LLM04: Supply Chain High LLM05: Data and Model Poisoning High LLM06: Unbounded Consumption High LLM07: Misinformation Medium LLM08: Hidden Context Exposure High LLM09: Vector and Embedding Weaknesses High LLM10: Improper Output Handling Critical

What Changed From the 2025 Edition

All ten 2025 risk areas survive into 2026, but the ordering was rebuilt using incident data alongside expert judgment, and one category was significantly broadened.

2026	Category	Was in 2025	Movement
LLM01	Prompt Injection	LLM01	No change
LLM02	Sensitive Information Disclosure	LLM02	No change
LLM03	Excessive Agency	LLM06	Up 3
LLM04	Supply Chain	LLM03	Down 1
LLM05	Data and Model Poisoning	LLM04	Down 1
LLM06	Unbounded Consumption	LLM10	Up 4
LLM07	Misinformation	LLM09	Up 2
LLM08	Hidden Context Exposure	LLM07 (System Prompt Leakage)	Renamed and broadened
LLM09	Vector and Embedding Weaknesses	LLM08	Down 1
LLM10	Improper Output Handling	LLM05	Down 5

If you built a control mapping or training deck against the 2025 numbering, the renumbering matters more than the content: LLM05 no longer means Improper Output Handling, and LLM06 no longer means Excessive Agency.

OWASP LLM Top 10 (2026) Summary

ID	Category	Risk	Primary Defense
LLM01	Prompt Injection	Critical	Input filtering, privilege separation, human-in-the-loop
LLM02	Sensitive Info Disclosure	Critical	PII scrubbing, output filtering, access controls
LLM03	Excessive Agency	Critical	Minimal functions, read-only defaults, human gates
LLM04	Supply Chain	High	AI-BOM, hash verification, trusted sources
LLM05	Data and Model Poisoning	High	Data provenance, sanitization, anomaly detection
LLM06	Unbounded Consumption	High	Rate limiting, token caps, cost alerting
LLM07	Misinformation	Medium	RAG grounding, fact-checking, human review
LLM08	Hidden Context Exposure	High	No secrets in context, per-user RAG authz, minimal tool schemas
LLM09	Vector & Embedding Weaknesses	High	Access controls, input validation, metadata filtering
LLM10	Improper Output Handling	Critical	Output encoding, CSP, never trust LLM output

Explore More AI Security Guides

For comprehensive tutorials and security guides:

Visit FixTheVuln.com →

Related Resources

🧠 AI Security Hub Guides, technique library, quizzes, and research on AI/LLM security 🛡️ OWASP Top 10 (Web) Classic web application security risks and remediation 💉 Prompt Injection Attacks Deep dive into direct and indirect prompt injection 🔌 API Security Best Practices Securing the APIs that power LLM applications 🗄️ GenAI Data Security (OWASP) 21 data-layer risks across GenAI systems

FixTheVuln Store

Study Planners Available for Both Certs

Fillable PDF study planners with domain trackers, weekly schedules, and progress tracking. Available in Standard, ADHD-Friendly, Dark Mode, and 4-Format Bundle.

CompTIA Security+ Planner EC-Council CEH Planner

60+ certifications available, from $5.99

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe ($4.99/mo)

CyberFolio

Choosing your next cert? Track them all in one place.

Build a free, shareable cybersecurity portfolio that highlights your certifications, projects, and skills.

Build Your Portfolio →