What it is
OWASP, the Open Worldwide Application Security Project, has published Top 10 lists for web application security since 2003, and its web list became the default checklist for a generation of developers and auditors. The GenAI Security Project applies the same format to applications built on large language models: ten risks, ranked, each with a description, examples, prevention guidance and attack scenarios.
Two things about the format matter for a governance programme. It is a list of risks, not a standard: nothing in it can be certified against, and claiming to conform to it means nothing formal. And it is about the application, not the model: most items describe failures in how an organisation wires a model into its own systems, which is why they belong in the deploying organisation's risk register rather than only in the model provider's.
The 2026 list
- LLM01 Prompt Injection. Untrusted content steering the model as if it were instructions. See prompt injection and the register entry prompt injection.
- LLM02 Sensitive Information Disclosure. The model revealing personal, confidential or proprietary data. Register: sensitive information disclosure.
- LLM03 Excessive Agency. More functions, permissions or autonomy than the task needs. Register: excessive agency in autonomous agents.
- LLM04 Supply Chain. Compromised models, datasets, adapters and dependencies. Register: LLM application supply chain vulnerabilities.
- LLM05 Data and Model Poisoning. Manipulated training, fine-tuning or embedding data. Register: data and model poisoning.
- LLM06 Unbounded Consumption. Uncontrolled inference causing outage or runaway cost. Register: unbounded resource consumption.
- LLM07 Misinformation. Confident, false output that people act on. Register: misinformation and confabulation.
- LLM08 Hidden Context Exposure. Leakage of anything the operator assumed users could not see, from the system prompt to retrieved documents. Register: hidden context exposure.
- LLM09 Vector and Embedding Weaknesses. Flaws in how retrieval stores are built, shared and accessed. Register: vector and embedding weaknesses.
- LLM10 Improper Output Handling. Model output passed to a browser, shell or database without validation. Register: improper output handling.
What changed from 2025
Only the first two items kept their places. Excessive agency rose from sixth to third, reflecting agentic systems reaching production and taking actions rather than producing text. Unbounded consumption rose from tenth to sixth, as reasoning models made each request more expensive. Misinformation rose from ninth to seventh. Improper output handling fell from fifth to tenth, not because it is solved but because the other risks grew faster.
And system prompt leakage was renamed and broadened to hidden context exposure. The 2025 item covered the system prompt; the 2026 item covers anything placed in the model's context on the assumption the user would not see it, including retrieved documents, schemas and policy logic. Nothing was added or removed outright. The register kept its system prompt leakage entry, because the older term still carries real search demand, and added hidden context exposure beside it.
How it differs from the Agentic Top 10 and MITRE ATLAS
OWASP publishes a separate Top 10 for Agentic Applications (December 2025), covering risks that only exist when a model acts: goal hijack, tool misuse, memory poisoning, cascading failures. An organisation deploying agents needs both lists, because every agent is also an LLM application.
MITRE ATLAS works at a different level. OWASP names categories of weakness and what to do about them; ATLAS catalogues the specific techniques adversaries use, in the style of MITRE ATT&CK. OWASP is the better structure for a risk register and a control set, and ATLAS the better structure for threat modelling and red-team planning. NIST's adversarial machine learning taxonomy (AI 100-2 E2025) supplies a third vocabulary, and the three are routinely mapped to one another.
Using it in a governance programme
Three uses, in order of value.
- As a coverage check on the risk register. For each of the ten, the register should hold a mapped risk with an owner and controls, or record why the item does not apply. This site's register maps every item, and the OWASP LLM Top 10 mapping shows the risks and controls behind each one, so a gap is visible at a glance.
- As the scope of a security test. An AI red teaming or penetration test of an LLM application that does not cover all ten has an undocumented gap. Asking a tester which items they covered, and how, is a fair procurement question.
- As a vendor question. Asking an AI vendor how their product addresses LLM01, LLM02 and LLM03 tells you quickly whether they have thought about the application layer at all.
What it is not is evidence of compliance. A statement that a system is aligned with the OWASP Top 10 asserts nothing an auditor can test. The evidence is the controls behind each item: system prompt hardening, output validation and guardrails, vector store and embedding access controls, inference usage quotas and rate limiting and adversarial robustness testing.
Frequently asked questions
What is the OWASP Top 10 for LLM Applications? A ranked list of the ten most critical security risks in applications built on large language models, published by the OWASP GenAI Security Project. The current edition is the 2026 list.
What is LLM01? Prompt injection, ranked first in both the 2025 and 2026 editions.
What happened to system prompt leakage? In 2026 it was renamed and broadened to hidden context exposure (LLM08), covering any content placed in the model's context on the assumption the user would not see it.
Is the OWASP LLM Top 10 a standard? No. It cannot be certified against and carries no legal force. Regulators and auditors look for the controls behind it, not the list itself.
Does it cover AI agents? Partly. Excessive agency (LLM03) does. The agent-specific risks are in OWASP's separate Top 10 for Agentic Applications.