OWASP Top 10 for LLM Applications (2026): every risk, its controls and the tools that help

OWASP’s LLM list began as the OWASP Top 10 for Large Language Model Applications, version 1.1 in 2023, and has since grown into the OWASP GenAI Security Project, which now runs a wider set of initiatives ^[5]. The project says its community passed 30,000 members in 2026 ^[3].

The list names the ten risks the community considers most critical for applications built on LLMs, and for each one describes how it happens, example attack scenarios and ways to prevent it ^[1][6][7]. OWASP says the 2026 edition maps its risks to frameworks including NIST guidance, MITRE ATLAS, CWE (MITRE’s Common Weakness Enumeration) and OWASP’s separate Top 10 for Agentic Applications ^[1].

LLM security, in OWASP’s framing, is mostly application security: most of the ten risks sit in what the application lets the model read, do and output, rather than in the model weights. Threats aimed at the model itself, such as extraction and backdoors, are covered in our AI model security guide, and protecting training and retrieval data in our AI data security guide.

All ten 2025 risk areas carried over under the same or a new name, eight of ten changed position, and OWASP says it “folded newer, sharper risks into the entries that already own them” rather than adding new entries ^[2][4]. The rename matters most for builders. System Prompt Leakage became Hidden Context Exposure, which OWASP describes as a broader entry: hidden context includes the schemas of tools the application exposes to the model, policy logic and workflow criteria, not only the system prompt ^[4].

OWASP says every earlier version of the list “was built on judgment” ^[4]. For 2026, the practitioner vote carries three-quarters of the weight and incident evidence the remaining quarter ^[4]. The team reviewed a corpus of 7,714 real incidents and classified the 6,639 that had enough detail to sort ^[4]. In OWASP’s words, a quarter weight “is enough to move an entry a tier when the gap between belief and evidence runs wide” ^[4].

The two inputs disagreed in telling ways. Prompt injection stays first, although ranked by the raw incident record it would fall out of the top ten entirely; OWASP attributes the gap to a defense effect, because teams fight injection hard ^[4]. Voters placed misinformation near the bottom while the incident record placed it near the top, and OWASP says the evidence “pulled it up” to the middle of the list ^[4]. Co-chair Steve Wilson told SD Times that excessive agency rose because AI systems now browse, call tools and act for users ^[8].

The table below condenses each risk into a definition, the controls OWASP recommends and the categories of tools on this site that help. Definitions and controls are drawn from OWASP’s 2025 risk pages and the 2026 document ^{[4][6][9][10][11][12][13][14][7][15][16]}. The tool categories are our mapping.

Each row is a documented case, research result or court decision. Research demonstrations are marked as such: they show that an attack works, not that it was used against a victim.

• 2023 to 2025: two new risks. System Prompt Leakage and Vector and Embedding Weaknesses were added, the second reflecting the spread of retrieval-augmented generation (RAG) ^[23].
• 2023 to 2025: renamed and widened. Model Denial of Service became Unbounded Consumption, which adds runaway cost; Overreliance was folded into Misinformation; Training Data Poisoning became Data and Model Poisoning; Excessive Agency was widened for agent architectures ^[23].
• Where Model Theft and Insecure Plugin Design went. Neither appears in the 2025 list ^[2][5]. Model extraction is now one of the outcomes of Unbounded Consumption ^[16], and on our reading plugin risks now sit mostly under Excessive Agency, whose controls are written around extensions ^[13].
• 2025 to 2026: same ten areas, new order. No new entry was added; newer risks were folded into existing ones. Excessive agency, unbounded consumption and misinformation rose; supply chain, poisoning, vector and embedding weaknesses and improper output handling fell; System Prompt Leakage was renamed Hidden Context Exposure ^[2][4].

Agents get their own list. The OWASP GenAI Security Project released the Top 10 for Agentic Applications on December 9, 2025, built with more than 100 experts, researchers and practitioners ^[24]. The 2026 LLM list maps its risks to the agentic list among other frameworks ^[1], and in September 2026 the project announced that an Agent Control Standard had been donated to it, aimed at enforcing agent controls at runtime ^[3].

Use the LLM list for any application that calls a model, and add the agentic list when the model can take actions: call tools, run code, keep memory or talk to other agents. Our AI agent governance guide maps each agentic risk to a control, and the AI agent security tools ranking covers products built for it.

No. OWASP calls the 2026 edition a “community-driven guide” ^[1]. We know of no certification against it and no law that requires it by name. It is still useful as evidence that you have assessed known LLM risks, and OWASP’s own advice is to “work all ten, start at the top” ^[4]. For what the EU AI Act requires of high-risk systems, see our EU AI Act hub.

1. 01

   List your LLM applications

   Record each application, the model it calls, the data it can read and the tools it can use. Our free AI risk register is a starting point.

2. 02

   Threat-model each one against the ten

   Mark which risks apply. An app with no tools has little excessive agency risk; a RAG app has vector and embedding risk; anything that renders output in a browser has output-handling risk ^[12][13][7].

3. 03

   Assign controls

   Use the mapping table above. Put authorization and least privilege outside the model, because the system prompt is not a security control ^[14].

4. 04

   Test before release

   Red team for prompt injection, data poisoning and data leakage, as NIST’s Generative AI Profile suggests ^[26]. Our red teaming hub explains methods, and the AI red team tools ranking covers scanners.

5. 05

   Add runtime controls

   Input and output filtering, redaction and tool-call checks catch what testing missed. See the AI guardrails guide.

6. 06

   Monitor in production

   Track usage, cost spikes, refusals and unusual outputs with an LLM observability platform; OWASP lists usage monitoring and anomaly detection under unbounded consumption ^[16].

7. 07

   Review against each new edition

   OWASP re-ranks the list: the 2026 edition moved eight of ten risks ^[2][4]. Re-run the threat model when a new edition or the agentic list changes.

• AI guardrails →Runtime filters for prompt injection, data leakage and unsafe output.
• AI model security →Extraction, backdoors, malicious model files and how to defend the model.
• AI data security →Protecting training, fine-tuning and RAG data, with the CISA/NSA practices.
• AI red teaming →How to test LLM applications against these risks.
• AI security vendors →Platforms that cover several of the ten risks at once.