The OWASP GenAI Security Project released the 2026 edition of its Top 10 for LLM Applications in early August. The Cloud Security Alliance dates publication to 3 August 2026, and Help Net Security reported the release on 6 August. It is the first edition where incident data carried part of the ranking, so the order is worth reading, not just the titles.
A caveat before the table. When we checked on 18 October 2026, OWASP's llm-top-10 landing page still showed the 2025 edition. The 2026 details below come from the Help Net Security and CSA write-ups, so confirm the exact wording against the OWASP PDF before you quote it in a policy.
What's affected
Anyone shipping an LLM feature where the model is a component of an application: a chat assistant, a summarizer, a RAG search box, a classifier in a workflow. OWASP draws a line here. Once a model acts with tools, memory and downstream consequences, the risks move to the separate OWASP Top 10 for Agentic Applications.
What changed, as reported:
- Prompt Injection (LLM01) and Sensitive Information Disclosure (LLM02) keep their first two places.
- Excessive Agency moved up to third.
- Unbounded Consumption rose four places.
- Misinformation climbed two places.
- Improper Output Handling fell from fifth to tenth.
- System Prompt Leakage was renamed Hidden Context Exposure and widened to cover retrieved documents, memory, user information, application state and tool responses.
- Prompt Injection now covers cross-modal attacks hidden in images or audio.
- Ranking weight: practitioner vote carried 75%, incident data on 6,639 classified incidents carried 25%.
The list, with one control each
| ID | Entry | A control you can ship this sprint |
|---|---|---|
| LLM01 | Prompt Injection | Treat all retrieved and user text as untrusted data. Enforce permissions outside the model, in code. |
| LLM02 | Sensitive Information Disclosure | Filter what enters the context by caller entitlement before the model sees it. Log redacted prompts. |
| LLM03 | Excessive Agency | One narrow tool per task, per-tool scopes, human approval for writes and sends. |
| LLM04 | Supply Chain | Pin model versions by digest, load safetensors, keep an inventory of models and datasets. |
| LLM05 | Data and Model Poisoning | Restrict who can write to training and retrieval corpora. Record the source of every document. |
| LLM06 | Unbounded Consumption | Per-user token and request budgets, max output length, timeouts, spend alerts. |
| LLM07 | Misinformation | Require citations to retrieved sources. Show uncertainty. Gate high-stakes outputs on review. |
| LLM08 | Hidden Context Exposure | Assume anything in context can be extracted. Keep secrets and other tenants' data out of it. |
| LLM09 | Vector and Embedding Weaknesses | Apply tenant and ACL filters in the vector query itself, not after retrieval. |
| LLM10 | Improper Output Handling | Never pass model output to a shell, SQL, or HTML renderer unescaped. Validate against a schema. |
The IDs follow the order given in the CSA note. Treat them as the 2026 numbering and do not mix them with the 2025 IDs in the same document.
How to check if you're exposed
Run a one-hour review per LLM feature with the table above as a checklist. For each row, write one of three answers: control in place and tested, control partly in place, or nothing. Attach a link to the code or config that proves it.
Three questions find most of the gaps fast:
- What can this model call, and with whose credentials?
- What text can an outsider put in front of the model, directly or through a document, email, ticket or web page?
- What does the application do with the model's output before a human reads it?
If the answers are "anything", "anyone" and "executes it", you have LLM01, LLM03 and LLM10 open at once.
What to do now
- Re-baseline your AI risk register against the 2026 numbering. Add Hidden Context Exposure as its own line, since it is broader than the old prompt leak entry.
- Audit confidentiality controls beyond the system prompt. Look at retrieved chunks, conversation memory and tool results, the places the renamed entry now covers.
- Inventory every LLM feature, the tools it can reach and the data it can read. CSA's note makes the same recommendation for agents.
- Move one enforcement decision per feature out of the prompt and into code. Permissions, tenant filters and output validation belong there.
- Add a budget limit to every endpoint that calls a model, so a loop or an abusive user hits a ceiling.
- Write down where your feature stops being an LLM application and becomes an agent. That is the point to start using the agentic list as well.
Why it matters
The most useful sentence in the coverage is OWASP's own framing, as quoted by Help Net Security: "Stop trying to build a model that cannot be fooled." Read it as an engineering instruction. The model will sometimes follow hostile text, so the controls that matter are the ones that limit what a fooled model can do.
OWASP also describes a "defense effect." Heavy mitigation work means fewer successful prompt injections reach public records, which makes the risk look smaller in incident data than it is.
One more detail is easy to miss. Misinformation was voted low by experts but ranked high in the incident data, which pushed it up. Teams that treat wrong answers as a quality issue and not a security issue may want to revisit that, especially where output feeds a decision.
Try it yourself
Pick one LLM feature in your product. Fill in the three-answer column for all ten rows and count how many say "nothing". Then map those rows to the policies and tests you already have.
Click through it at your own pace, or open it full screen.
Quick check
Which entry was renamed, and what does it cover now?
System Prompt Leakage became Hidden Context Exposure. It covers retrieved documents, memory, user information, application state and tool responses, not just the system prompt text.
Why did Improper Output Handling fall to tenth?
Reporting says it fell from fifth and absorbed more scope. A lower rank is not a lower danger: unescaped model output reaching a shell or renderer is still a code execution path.
Where do tools, memory and downstream actions get covered?
In the separate OWASP Top 10 for Agentic Applications. The LLM list covers the model as a component of an application.
