OWASP LLM Top 10 2026 vs Agentic Top 10
Model or Agent — Which List, When
The OWASP LLM Top 10 and the OWASP Agentic Top 10 (ASI) are not competitors — they cover two sides of one boundary. This guide shows where that boundary sits, names the handoff point, and helps you pick the right list for what you are actually building.
In 30 seconds
- Model as a component → OWASP LLM Top 10 (2026). Chatbots, RAG, single-model apps that take input and return text.
- Model as an actor → add the OWASP Agentic Top 10 (ASI). The moment it can call tools, keep memory across sessions, or trigger downstream consequences.
- The handoff is named inside the LLM list. LLM03 Excessive Agency moved up to #3 in 2026 and carries the agency-side treatment of prompt injection — the seam into the Agentic list.
- Most real systems need both. Run the LLM Top 10 as the baseline; layer the Agentic Top 10 per capability you grant.
- Read the table below as a map, not a spec. The LLM-to-ASI pairings are AltaySec's thematic reading, not OWASP-declared mappings.
The boundary: model as component vs model as actor
Both lists were published by the OWASP GenAI Security Project, and they divide the risk landscape along one line: what the model is allowed to do with its output.
The LLM Top 10 owns the risk when the model is a component. It ingests input and produces output; the surrounding application decides what happens next. A support chatbot, a RAG search box, a summarizer, a classifier — in each, a human or trusted application code reads the answer and acts on it. The failure modes are about what goes into the token stream and what comes out of it.
The Agentic Top 10 owns the risk when the model becomes an actor. The 2026 document states the boundary directly: the moment the model has tools it can call, memory across sessions, and downstream consequences, the risk moves to the Agentic list. Three tripwires mark the crossing:
- Tools — the output can invoke a function, hit an API, run code, or send a message.
- Memory — state persists across turns or sessions, so today's input shapes tomorrow's behavior.
- Consequences — an action has a blast radius outside the chat window: a payment, a file write, an email, a deployment.
Trip any one and you are no longer running a single-model app. Pair the two lists.
The handoff point: LLM03 Excessive Agency
The seam between the two lists is not implicit — it is an entry. LLM03 Excessive Agency is the revision's most consequential move, rising from #6 to #3. Both the community vote and the incident record agree that agentic deployments are where the damage actually lands, and LLM03 carries the full agency-side treatment of prompt injection.
Read LLM03 as the doorway. Inside the LLM Top 10 it warns you that excessive permissions, over-broad tool access, and unconstrained autonomy turn a language error into a real-world action. Once you cross that doorway — once the model genuinely acts — its single entry expands into the ten entries of the Agentic Top 10, where tool misuse, identity abuse, memory poisoning, and rogue agents each get their own treatment.
Practically: if LLM03 is a live concern for your system, that is the signal to open the Agentic Top 10, not just to tighten one permission.
Side by side: LLM01-10 and their agentic counterparts
The left two columns are the official 2026 LLM Top 10 and a one-line trigger for when each applies. The right column is a thematic pointer to the Agentic (ASI) entry that carries the same theme once the model acts — AltaySec's analytical reading to help you navigate between the lists, not an OWASP-declared pairing.
| LLM Top 10 (2026, official) | When it applies (component view) | Thematic ASI counterpart (analytical) |
|---|---|---|
| LLM01 Prompt Injection | Any untrusted content — user text, retrieved doc, image or audio — enters the token stream. | ASI01 Agent Goal Hijack; ASI06 Memory and Context Poisoning |
| LLM02 Sensitive Information Disclosure | The model ingests or memorizes sensitive data it can later reveal. | ASI03 Identity and Privilege Abuse |
| LLM03 Excessive Agency | The output can cause an action; permissions or autonomy exceed need. The handoff. | The whole Agentic list — esp. ASI02 Tool Misuse and Exploitation, ASI10 Rogue Agents |
| LLM04 Supply Chain | A model, plugin, or dataset artifact may not be what it claims. | ASI04 Agentic Supply Chain Vulnerabilities |
| LLM05 Data and Model Poisoning | Training or fine-tuning data, or the model itself, can be subverted. | ASI06 Memory and Context Poisoning |
| LLM06 Unbounded Consumption | Cost or compute has no ceiling — denial-of-wallet, DoS, model extraction. | ASI08 Cascading Failures |
| LLM07 Misinformation | The output is trusted as fact without grounding or verification. | ASI09 Human-Agent Trust Exploitation |
| LLM08 Hidden Context Exposure | System prompt, session state, or inferred role/permissions can leak. | ASI03 Identity and Privilege Abuse |
| LLM09 Vector and Embedding Weaknesses | RAG retrieval can be poisoned or leak across tenants. | ASI06 Memory and Context Poisoning |
| LLM10 Improper Output Handling | A downstream system executes model output unsanitized — code, SQL, HTML. | ASI05 Unexpected Code Execution; ASI02 Tool Misuse and Exploitation |
Two Agentic entries have no clean single-model equivalent: ASI07 Insecure Inter-Agent Communication and ASI10 Rogue Agents exist only once you have more than one agent, or an agent operating unsupervised. They are a clear sign you have left the LLM Top 10's scope entirely.
Prompt injection is the thread through both lists
LLM01 Prompt Injection stayed at #1 in 2026 and now explicitly covers cross-modal attacks carried in images and audio. It is also the reason the two lists cannot be run in isolation: injection is the delivery vector, and agency is the payload.
Three deployment properties make it worse as you move toward agents:
- Context-window pooling — system prompt, user input, retrieved documents, tool outputs, history, and memory share one token stream with no enforced trust boundary.
- Memory persistence — an injection written into long-term memory or a RAG store taints every future session.
- Agentic execution — the output drives tool calls, so the blast radius extends to whatever the agent's tools can reach.
No reliable prevention exists today, consistent with NIST and NCSC guidance from 2025. Two framings help you decide where a human must stay in the loop: Simon Willison's lethal trifecta (private data + untrusted content + external communication together enable high-impact exploitation; remove one leg and it collapses), and Meta's Rule of Two (any combination of untrusted input, sensitive data, and state change or external comms should require per-action human approval). Both are agency questions — which is exactly why LLM03 hands you off to the Agentic Top 10.
Which list, when
Use the LLM Top 10 on its own when the model is a component and a human or trusted application code decides what to do with each answer:
- Support or FAQ chatbots that only return text.
- RAG search and Q&A that retrieves and answers but does not act.
- Summarization, classification, extraction, and drafting.
Add the Agentic Top 10 the moment any tripwire trips — tools, memory, or consequences:
- The model can call a function, API, or shell.
- State persists across sessions and shapes later behavior.
- An action reaches outside the chat: payments, file writes, emails, deployments, other agents.
Adding the Agentic list does not retire the LLM list. LLM01 remains your untrusted-input surface; it simply becomes the delivery vector for ASI01 Agent Goal Hijack. Treat the LLM Top 10 as the baseline you apply to every LLM feature, and layer the Agentic Top 10 per capability you grant — hold credentials and state-change in application code, budget agent capabilities, and require human confirmation for privileged, irreversible, or externally visible actions.
Honesty note and sources
The English entry titles used here are the official OWASP titles from the Top 10 for LLM Applications 2026, released 2026-08-04 by the OWASP GenAI Security Project under CC BY-SA 4.0. The Agentic Top 10 (ASI) entry titles were announced 2025-12-09. The one-line "when it applies" summaries and the LLM-to-ASI mappings in this article are a community-maintained, analytical derivative (also CC BY-SA 4.0); the authoritative text lives in the official OWASP documents, which you should treat as the source of record.
For what actually changed in the LLM list this year — the reordering, the incident-tested methodology, and the renamed entries — see the AltaySec overview: OWASP LLM Top 10 2026: what changed. The Agentic list is covered in depth here (currently Turkish only): OWASP Agentic Top 10 (ASI).
Primary and derivative sources:
Frequently Asked Questions
Do I need both OWASP lists?
Most production systems do. Use the LLM Top 10 as the baseline for any LLM feature, then add the Agentic Top 10 the moment the model can call tools, keeps memory across sessions, or triggers downstream consequences.
Which list applies to a RAG chatbot?
The LLM Top 10 alone if it only retrieves and answers. Poisoned retrieval is LLM09 and LLM01; but the moment the chatbot can act on what it reads — send an email, update a record, call an API — add the Agentic Top 10.
Where exactly is the handoff between the two lists?
At LLM03 Excessive Agency, which moved up from #6 to #3 in 2026. It carries the agency-side treatment of prompt injection and is the explicit seam into the Agentic Top 10. If LLM03 is a live concern, open the Agentic list.
Are the LLM-to-ASI mappings in the table official?
No. The English entry titles are the official OWASP titles for both lists. The row-by-row pairings are AltaySec's thematic, analytical reading to help you navigate between the lists — not OWASP-declared mappings.
Does adding the Agentic Top 10 replace the LLM Top 10?
No. Prompt injection (LLM01) remains your untrusted-input surface and becomes the delivery vector for ASI01 Agent Goal Hijack. Run the LLM Top 10 as the baseline and layer the Agentic Top 10 per capability you grant.
Which Agentic risks have no single-model equivalent?
ASI07 Insecure Inter-Agent Communication and ASI10 Rogue Agents. They only exist once you have multiple agents or an agent running unsupervised, so encountering them is a clear sign you have left the LLM Top 10's scope.
Sources
| Resource | Link |
|---|---|
| OWASP Top 10 for LLM Applications 2026 (official) | genai.owasp.org |
| owasp-llm-top10-2026-tr — community derivative (GitHub) | github.com |
| owasp-llm-top10-2026-tr dataset (Hugging Face) | huggingface.co |