The OWASP Top 10 for LLM Applications remains one of the most useful starting points for securing generative AI systems. The 2026 edition keeps the same ten-risk format, but it changes the order, broadens several categories, and gives more attention to agentic systems, persistent memory, multimodal inputs, model supply chains, and evidence from real-world incidents.
The headline is simple: the 2026 list is less focused on a chatbot in isolation and more focused on the complete system around the model.
OWASP Top 10 for LLM Applications: 2025 vs. 2026
| 2025 rank and risk | 2026 rank and risk | What changed |
|---|---|---|
| 1. Prompt Injection | 1. Prompt Injection | Still the top risk; coverage now explicitly includes multimodal and persistent-context attacks. |
| 2. Sensitive Information Disclosure | 2. Sensitive Information Disclosure | Remains unchanged and expands to traces, embeddings, telemetry, and side channels. |
| 3. Supply Chain | 4. Supply Chain | Moves down one position but now includes model provenance, adapters, conversion, and quantization workflows. |
| 4. Data and Model Poisoning | 5. Data and Model Poisoning | Moves down one position and absorbs more persistent-data and inference-artifact scenarios. |
| 5. Improper Output Handling | 10. Improper Output Handling | Falls to the bottom of the list, but its scope grows to include generated code, terminal output, and automatic outbound requests. |
| 6. Excessive Agency | 3. Excessive Agency | The biggest upward move, reflecting the growing impact of tools, permissions, and autonomous actions. |
| 7. System Prompt Leakage | 8. Hidden Context Exposure | Renamed and broadened beyond system prompts to include tool schemas, policies, roles, and operational context. |
| 8. Vector and Embedding Weaknesses | 9. Vector and Embedding Weaknesses | Moves down one position and adds stronger emphasis on inversion, cross-tenant inference, and semantic-cache attacks. |
| 9. Misinformation | 7. Misinformation | Moves up two positions as false model output increasingly influences workflows and automated decisions. |
| 10. Unbounded Consumption | 6. Unbounded Consumption | Moves up four positions to reflect denial-of-wallet, reasoning loops, multimodal cost, and tool-call fan-out. |
The biggest change: agency moves to number three
Excessive Agency rises from #6 to #3. This reflects a shift from conversational applications toward agents that can read mail, modify files, call APIs, execute code, and make decisions across multiple steps.
The 2026 guidance separates three related problems:
- Excessive functionality: a tool exposes capabilities the task does not require.
- Excessive permissions: the tool operates with a broad or shared identity.
- Excessive autonomy: high-impact actions happen without independent verification or approval.
The practical response is least privilege, narrowly scoped tools, complete mediation in application code, user-context authorization, action limits, and human approval for irreversible operations. This is also where the boundary with the OWASP Top 10 for Agentic Applications becomes important.
Unbounded Consumption climbs four places
In 2025, Unbounded Consumption was tenth. In 2026, it is sixth because LLM resource abuse is no longer limited to high request volume. Newer systems introduce several additional cost and availability risks:
- extended-thinking or reasoning-token exhaustion;
- large-context requests that remain just below API limits;
- expensive image, audio, and video inputs;
- recursive tool calls and agent fan-out;
- model extraction through high-volume querying; and
- denial-of-wallet attacks against pay-per-token services.
Request-per-second limits are not enough. Teams should add token quotas, pre-flight cost estimates, hard spending caps, recursion limits, per-run budgets, and circuit breakers.
Misinformation moves from ninth to seventh
The 2026 edition treats misinformation as a system-level security issue rather than only a model-quality problem. Incorrect or incomplete output can now be consumed by another agent, used to infer system state, or passed directly into a business workflow.
Recommended controls include separating claim, verification, and action; grounding important claims in current authoritative sources; validating tool arguments and preconditions; requiring mandatory fields in structured output; and adding human review to high-impact decisions.
A fluent answer is not evidence. Confidence scores alone are not a sufficient verification signal.
System Prompt Leakage becomes Hidden Context Exposure
The 2025 category System Prompt Leakage is renamed Hidden Context Exposure and moves from #7 to #8. The change recognizes that sensitive context includes more than a system prompt. It may also include:
- developer instructions and policy logic;
- retrieved policy or profile data;
- tool names, schemas, and permission hints;
- role and workflow information; and
- output-formatting and validation rules.
The 2026 guidance makes an important architectural point: hidden context should not be treated as a secret or an authorization boundary. Never place credentials, connection strings, or security-critical permissions in prompts. Enforce authorization deterministically outside the model.
Categories that expanded without being renamed
Several risks retain their names but cover a broader attack surface in 2026:
- Prompt Injection now explicitly covers instructions hidden in images, audio, video, retrieved content, tool output, and persistent memory.
- Sensitive Information Disclosure includes reasoning traces, tool arguments, logs, telemetry, embeddings, model behavior, and measurable side channels.
- Supply Chain includes model artifacts, LoRA adapters, conversion and merge services, quantization, mutable model names, and AI-suggested packages.
- Data and Model Poisoning reaches fine-tuning, RAG, embeddings, continuous-learning pipelines, chat templates, tokenizers, and other inference artifacts.
- Improper Output Handling now calls out unsafe generated code, SQL, HTML, terminal control sequences, Markdown images, link previews, and other automatic outbound requests.
For a defensive mapping of OWASP risks to attacker techniques and mitigations, see Mapping MITRE ATLAS to OWASP for LLMs. For broader governance and deployment guidance, the CISO’s guide to AI security provides useful context.
What security teams should do now
A practical 2026 adoption plan is short:
- Inventory the full AI system: models, prompts, RAG indexes, tools, agents, adapters, datasets, and observability platforms.
- Reduce agency: remove unnecessary tools, narrow permissions, preserve user authorization, and require confirmation for high-impact actions.
- Protect the supply chain: pin and verify model artifacts, maintain an AI BOM, review licenses, and test conversion and deployment pipelines.
- Control cost and execution: set token and spending limits, cap agent steps, monitor tool fan-out, and use circuit breakers.
- Validate before trust: treat model output as untrusted input and verify claims, tool arguments, generated code, SQL, and rendered content.
- Test adaptive attacks: red-team prompt injection, memory poisoning, multimodal inputs, hidden-context extraction, vector inversion, and model artifacts.
Organizations operating AI across multiple clouds should also connect these controls to identity, logging, data protection, and workload governance. The AI multi-cloud security guide covers that broader operating model.
Conclusion
The OWASP 2026 update does not replace the 2025 list; it makes the list more representative of how modern AI applications are actually deployed. Prompt injection and sensitive information disclosure remain foundational risks, while excessive agency, unbounded consumption, and misinformation become more prominent as AI systems gain tools and influence business processes.
The main lesson is to secure the system around the model. Use the model for probabilistic tasks, but keep identity, authorization, validation, budgets, and irreversible actions under deterministic application control.
To further enhance your cloud and AI-agent security, contact me on LinkedIn or [email protected].
Frequently Asked Questions (FAQ)
What is the OWASP Top 10 for LLM Applications 2026?
The OWASP Top 10 for LLM Applications 2026 is a practical security framework covering the ten most important risks in applications that use large language models. The 2026 edition updates the rankings and expands coverage for agents, multimodal inputs, persistent memory, model supply chains, vector stores, and AI-generated output.
What changed between the OWASP Top 10 for LLM Applications 2025 and 2026?
The 2026 edition keeps ten categories but changes their order, moves Excessive Agency from sixth to third, moves Unbounded Consumption from tenth to sixth, moves Misinformation from ninth to seventh, and renames System Prompt Leakage as Hidden Context Exposure. Several categories also expand to cover agents, memory, multimodal content, model artifacts, and side-channel disclosure.
What is the biggest change in the OWASP LLM Top 10 2026?
The biggest ranking change is Excessive Agency moving from number six in 2025 to number three in 2026. OWASP emphasizes that excessive tools, permissions, or autonomy can turn prompt injection and model errors into unauthorized data access, destructive actions, or high-impact business decisions.
Why did Excessive Agency move higher in the 2026 OWASP LLM Top 10?
Excessive Agency moved higher because modern LLM applications increasingly call tools, access enterprise data, maintain memory, and act across multiple steps. The recommended defenses are least-privilege tools, narrowly scoped permissions, complete mediation outside the model, user-context authorization, circuit breakers, and human approval for irreversible actions.
What replaced System Prompt Leakage in the OWASP Top 10 2026?
System Prompt Leakage was renamed Hidden Context Exposure and ranked eighth. The broader category includes system prompts, developer instructions, retrieved policies, tool schemas, roles, workflow logic, and output-formatting rules. OWASP recommends assuming hidden context can be discovered and never placing credentials or security-critical authorization logic inside it.
How should organizations prepare for the OWASP Top 10 for LLM Applications 2026?
Start by inventorying models, prompts, datasets, RAG indexes, tools, agents, adapters, and observability systems. Then reduce unnecessary agency, verify model and dataset artifacts, set token and spending limits, validate every model output before downstream use, and continuously red-team prompt injection, memory poisoning, vector attacks, hidden-context extraction, and multimodal inputs.
This article summarizes and adapts material from the OWASP Top 10 for LLM Applications 2026, licensed under CC BY-SA 4.0. OWASP and the OWASP logo are trademarks of the OWASP Foundation. The official project materials are available at genai.owasp.org.
