OWASP LLM Top 10 2026
What Changed (LLM01–LLM10)

Note: The English risk IDs and titles below are the official OWASP titles (verified against the official document). The summaries are concise editorial summaries and the machine-readable JSON is a community-maintained derivative. Official document: genai.owasp.org (CC BY-SA 4.0).

In 30 seconds

• Released: 2026-08-04 by the OWASP GenAI Security Project. License: CC BY-SA 4.0.
• The most consequential move: Excessive Agency climbed from 6th to 3rd — both the community vote and the incident record agree the damage is landing in agentic deployments.
• Rename: 2025's System Prompt Leakage became the broader Hidden Context Exposure (7->8).
• Biggest riser / faller: Unbounded Consumption 10->6, Improper Output Handling 5->10 (the furthest fall).
• Unchanged top two: Prompt Injection (#1) and Sensitive Information Disclosure (#2).
• Method: for the first time the vote (75% weight) was tested against an incident record (25%): 7,714 real incidents collected, 6,639 sortable.

2025 -> 2026 change map

Moves are derived from OWASP's official rank-migration chart (a direct comparison of the 2025 and 2026 releases).

Notable changes and why

Excessive Agency climbed to #3 (6->3). The most consequential move on the list. Per the project leads, the vote and the incident record point the same way here: agentic deployments are where the damage lands. Prompt injection is the input-side compromise; excessive functionality, permissions, or autonomy are what turn that compromise into consequential actions outside the chat window. LLM03:2026 carries the full agency-side treatment of prompt injection.

Unbounded Consumption rose four places (10->6), carried by practitioners who weigh resource and cost exhaustion (denial-of-wallet, DoS, model extraction) higher than its old rank.

Improper Output Handling fell the furthest (5->10) but grew in scope: it now spans the insecure code that assistants generate at scale.

System Prompt Leakage -> Hidden Context Exposure. The narrow 2025 entry became a broader framing: the failure to keep information (system prompt and hidden context/state) out of reach.

Prompt Injection is now cross-modal, explicitly covering attacks that hide instructions inside an image or an audio track. Supply Chain now accounts for a promoted model artifact not being what it claims, and Data and Model Poisoning absorbs fine-tuning subversion.

Why is Prompt Injection still #1? The "defense effect"

The most instructive finding of the 2026 release. Ranked by raw incident count, Prompt Injection falls out of the top 10 entirely. It was still kept at #1. The reason is what OWASP calls the defense effect: teams fight injection so hard that clean exploits reach public vulnerability databases less often — so the public count understates the real risk. Because the model always reads untrusted input, this surface can never be closed; an un-closable surface earns the top spot.

The same tension runs the other way for Misinformation: voters placed it low, the incident record placed it high (the widest gap in the harmful direction); the list seated it in the middle, 9->7. The lesson: when a model's fluent, confident-but-wrong output drives a decision or a tool call, the failure lands more often than the vote assumes.

The 2026 list at a glance

1. LLM01:2026 Prompt Injection. Input (direct, retrieved content, tool output, image/audio, reasoning, or persistent memory) alters behavior; LLMs make no architectural distinction between instructions and data.
2. LLM02:2026 Sensitive Information Disclosure. The model discloses sensitive data via its outputs, including reasoning-channel content. The one top slot where vote and evidence agree, and confidence is highest.
3. LLM03:2026 Excessive Agency. Excessive functionality, permissions, or autonomy let a compromised model take consequential actions outside the chat window.
4. LLM04:2026 Supply Chain. Trust failures in third-party models, tool packages, and now the model artifact itself.
5. LLM05:2026 Data and Model Poisoning. Poisoned training/fine-tuning/embedding data or weights; now absorbs fine-tuning subversion.
6. LLM06:2026 Unbounded Consumption. Uncontrolled resource and cost exhaustion (denial-of-wallet, DoS, model extraction).
7. LLM07:2026 Misinformation. Fluent, confident but wrong output that drives a wrong decision or tool call.
8. LLM08:2026 Hidden Context Exposure. Failure to keep information (system prompt, hidden context) out of reach; the successor to System Prompt Leakage.
9. LLM09:2026 Vector and Embedding Weaknesses. Retrieval poisoning, embedding inversion, and cross-context leakage in RAG systems.
10. LLM10:2026 Improper Output Handling. Insufficient validation/sanitization before downstream systems act; now spans insecure code assistants generate at scale.

What to do — defense priorities

The reshuffle carries a message: risk grows when the model stops being a component and becomes an actor.

• Budget agent capability (LLM03). Meta's "Rule of Two" as a floor: an agent should hold at most two of (A) untrusted input, (B) sensitive data, (C) state change; require per-action human approval otherwise. Use a deterministic policy engine and least privilege for high-impact actions.
• Strip invisible characters. Tag-block (U+E0000–E007F), variation selectors, and zero-width characters should be stripped at every ingest and render boundary.
• Validate output with a strict schema (LLM10) in trusted application code — not a second LLM — before any downstream system acts.
• Test guardrails on non-English input. Classifiers tuned for English can silently miss attacks phrased in other languages; test defenses against the languages your users actually speak.
• When the model becomes an actor, pair this list with the OWASP Agentic Top 10; neither covers that ground alone.

Machine-readable data & sources

To embed this list in your tools, CI gates, or scorecards, we published the list, translations, and the 2025->2026 change map as open machine-readable JSON:

The official 2026 document also maps to MITRE ATLAS (v2026.06), MITRE ATT&CK, CWE 4.20, NIST AI 600-1 / AI RMF, CSA AICM, and OWASP AIVSS (see Appendix A).

Frequently Asked Questions

When was the OWASP LLM Top 10 2026 released?

It was released on 2026-08-04 by the OWASP GenAI Security Project under CC BY-SA 4.0. For the first time the community vote was tested against a record of real incidents: 7,714 incidents were collected from public vulnerability databases and an AI-harm database, 6,639 of which carried enough detail to sort. The vote carries three-quarters of the weight; the incident data covers the remaining quarter.

What are the biggest changes from 2025?

Excessive Agency moved up 6->3 (the most consequential move), Unbounded Consumption 10->6, Improper Output Handling fell 5->10 (the furthest fall), and 2025's System Prompt Leakage was renamed and re-scoped into Hidden Context Exposure (7->8). Prompt Injection (#1) and Sensitive Information Disclosure (#2) held the top two spots.

Why is Prompt Injection still #1?

Ranked by raw incident count it falls out of the top 10 entirely. It stays #1 because of a 'defense effect': teams fight injection so hard that clean exploits reach public databases less often, so the public count understates the real risk. The untrusted-input surface can never be closed, so it keeps the top spot.

How is Hidden Context Exposure different from System Prompt Leakage?

The 2026 entry broadens the narrow 'system prompt leaking' framing into the failure to keep any information (system prompt and hidden context/state) out of reach, and it moved 7->8.

Is this the official OWASP list?

The English IDs and titles here are the official OWASP titles, verified against the official document. The summaries are concise editorial summaries and the machine-readable JSON is a community-maintained derivative (CC BY-SA 4.0); the authoritative descriptions live in the official OWASP document.

Sources