OWASP Top 10 for LLM Applications, mapped to risks and controls.
The OWASP Top 10 for LLM Applications is the OWASP GenAI Security Project’s list of the ten security risks most likely to matter in an application built on a large language model. It is an awareness document, not a standard: it names the risks, describes how they are exploited, and leaves the question of which controls to run, and in what order, to the organisation. The 2026 edition, published on 3 August 2026, kept the ten-entry shape, renumbered most of the list, and widened the old System Prompt Leakage entry into Hidden Context Exposure at LLM08, which now covers anything the operator assumed a user could not reach: retrieval context, schemas, policy logic, not only the prompt.
This page answers the question the list leaves open. Each of the ten entries is matched to the risks in the Axiom Verity register that describe it, and to the controls that address those risks, with the strength of each control marked: primary, supporting, or compensating. The table shows the coverage at a glance; the sections below it show the mapping entry by entry. Where an entry maps to a single control, that is a statement about the register, not a claim that one control is enough.
For what the list is and how it has changed, see the OWASP Top 10 for LLM Applications glossary entry. For the entry that generates most of the questions, LLM01, the prompt injection article sets out what a governance function can actually ask for.
Published by OWASP GenAI Security Project: the official list(opens in a new tab). Last reviewed: 2026-10-07
All 10 entries at a glance
| Entry | Title | Risks | Controls |
|---|---|---|---|
| LLM01 | Prompt Injection | 1 | 2 |
| LLM02 | Sensitive Information Disclosure | 1 | 2 |
| LLM03 | Excessive Agency | 1 | 2 |
| LLM04 | Supply Chain | 1 | 2 |
| LLM05 | Data and Model Poisoning | 1 | 2 |
| LLM06 | Unbounded Consumption | 1 | 2 |
| LLM07 | Misinformation | 1 | 2 |
| LLM08 | Hidden Context Exposure | 2 | 2 |
| LLM09 | Vector and Embedding Weaknesses | 1 | 1 |
| LLM10 | Improper Output Handling | 1 | 1 |
LLM01 Prompt Injection
Crafted input that overrides system instructions, directly or via untrusted retrieved content.
Prompt injection
Attacker-controlled input overrides system instructions, either directly or via retrieved/tool content treated as trusted.
Output validation and guardrails
Deterministic schema validation and sanitisation of AI-generated output before it reaches any downstream system.
Human-in-the-loop review
Mandatory human approval gate for high-consequence or irreversible AI-generated actions before they take effect.
LLM02 Sensitive Information Disclosure
Model output reveals sensitive data the requester should not have access to.
Sensitive information disclosure
A model surfaces training, fine-tuning, or retrieval-sourced sensitive data in its output.
Output validation and guardrails
Deterministic schema validation and sanitisation of AI-generated output before it reaches any downstream system.
AI system monitoring and logging
Continuous telemetry, drift detection, and audit logging of AI system inputs, outputs, and overrides.
LLM03 Excessive Agency
Excessive functionality, permissions, or autonomy granted to an LLM-based system.
Excessive agency in autonomous agents
An agent is granted more permission, tool access, or autonomy than the task requires.
Human-in-the-loop review
Mandatory human approval gate for high-consequence or irreversible AI-generated actions before they take effect.
AI system monitoring and logging
Continuous telemetry, drift detection, and audit logging of AI system inputs, outputs, and overrides.
LLM04 Supply Chain
Vulnerabilities in the LLM supply chain: training data, pre-trained models, plugins, and deployment infrastructure sourced from third parties.
LLM application supply chain vulnerabilities
Vulnerable or unvetted components — base models, adapters, datasets, plugins, deployment platforms — enter an LLM application through its supply chain.
Training data provenance checks
Documented verification of the source, licensing, and integrity of any dataset before it is used for training or fine-tuning.
Third-party model and vendor due diligence
Pre-procurement and ongoing due-diligence policy for the selection and contractual oversight of third-party AI models and datasets.
LLM05 Data and Model Poisoning
Training, fine-tuning, or embedding data manipulated to introduce vulnerabilities, backdoors, or biases into a model.
Data and model poisoning
Training, fine-tuning, or embedding data is deliberately manipulated to introduce vulnerabilities, backdoors, or bias into a model.
Training data provenance checks
Documented verification of the source, licensing, and integrity of any dataset before it is used for training or fine-tuning.
Model artifact signing and integrity verification
Cryptographic signing of trusted model artifacts and verification of that signature before a model is loaded into production.
LLM06 Unbounded Consumption
Unrestricted or excessive inference requests leading to denial of service, denial of wallet, or model theft.
Unbounded resource consumption
Unrestricted or excessive inference requests lead to denial of service, denial of wallet, or facilitate model theft.
Inference usage quotas and rate limiting
Per-user and per-tenant limits on request volume, input length, and context-window usage for an AI system's inference endpoint.
AI system monitoring and logging
Continuous telemetry, drift detection, and audit logging of AI system inputs, outputs, and overrides.
LLM07 Misinformation
LLM output presents false or misleading information as fact, including confidently stated fabrications.
Misinformation and confabulation
A model states false or fabricated information with the same linguistic confidence as accurate information.
Factuality and hallucination verification
Automated or human fact-checking of AI-generated output against a trusted source before it is relied on for a consequential decision.
Human-in-the-loop review
Mandatory human approval gate for high-consequence or irreversible AI-generated actions before they take effect.
LLM08 Hidden Context Exposure
Exposure of content assumed hidden from the user (the system prompt, RAG schemas, retrieval context, or policy logic), reachable through the model even though the operator never intended it to be user-visible. Broadened in the 2026 list from the 2025 System Prompt Leakage category.
System prompt leakage
The system prompt is extracted or inferred, exposing configuration, guardrail logic, or embedded credentials.
Hidden context exposure
Content the operator assumed was hidden from the user, such as retrieval context, RAG schemas, or policy logic, is exposed or inferred through the model, beyond just the system prompt.
System prompt hardening
Design and testing practice that keeps system prompts free of secrets and resilient to extraction attempts.
Output validation and guardrails
Deterministic schema validation and sanitisation of AI-generated output before it reaches any downstream system.
LLM09 Vector and Embedding Weaknesses
Vulnerabilities in how vectors and embeddings are generated, stored, or retrieved in retrieval-augmented generation systems.
Vector and embedding weaknesses
Weaknesses in how vectors and embeddings are generated, stored, or retrieved in a retrieval-augmented generation pipeline let an attacker poison or exfiltrate the knowledge base.
Vector store and embedding access controls
Access control, input validation, and tenant isolation applied to a RAG pipeline's vector store, the same as any other production data store.
LLM10 Improper Output Handling
Insufficient validation, sanitisation, and handling of LLM-generated output before it is passed to downstream systems.
Improper output handling
AI-generated output is passed to a downstream interpreter, renderer, or system call without validation, enabling injection-style attacks beyond the model itself.
Output validation and guardrails
Deterministic schema validation and sanitisation of AI-generated output before it reaches any downstream system.