What changed in the 2026 list
Earlier editions of the list rested on a vote. The 2026 edition tested the vote against a record of what went wrong: 7,714 incidents from public vulnerability databases and an AI-harm database, of which classifiers sorted the 6,639 that carried enough detail. The vote still carries three-quarters of the weight. The incident data carries the rest.
The two disagree in useful places. By the raw incident record, prompt injection falls out of the top 10. OWASP reads that as a defense effect: teams fight injection hard, so fewer clean exploits reach a public database. It stays first. Misinformation runs the other way. Voters put it near the bottom, the incident record put it near the top, and it landed in the middle, at seventh.
The order moved more than in past years. Excessive Agency climbed to third, because the vote and the record agree that agentic deployments are where the damage is landing. Unbounded Consumption rose four places. Improper Output Handling fell furthest, from fifth to tenth. What used to be System Prompt Leakage is now Hidden Context Exposure, which lesson 2 covered.
Several entries also grew instead of adding new ones. Prompt injection now covers attacks that hide instructions in an image or an audio track. Supply chain covers a promoted model artifact that is not what it claims to be. Poisoning absorbs fine-tuning subversion, and output handling spans the insecure code that assistants generate.
7,714
incidents collected from public vulnerability databases and an AI-harm database
Source: GitHub: OWASP GenAI LLM Top 10 2026, preface (read November 6, 2026)
6,639
of them detailed enough to classify
Source: GitHub: OWASP GenAI LLM Top 10 2026, preface (read November 6, 2026)
75%
of the weight went to the community vote
Source: GitHub: OWASP GenAI LLM Top 10 2026, preface (read November 6, 2026)
25%
went to the incident data
Source: GitHub: OWASP GenAI LLM Top 10 2026, preface (read November 6, 2026)
The ten risks, each in one line
Each row gives the 2026 number, what goes wrong in plain words, one of the first controls the entry's prevention list names, and where the risk stood in 2025. The full entries sit in OWASP's source folder, each with examples, mitigations and attack scenarios.
| 2026 | Risk | What goes wrong | A first fix | 2025 |
|---|---|---|---|---|
| 1 | Prompt Injection | Text from a user, a document, a tool result, an image or memory changes what the model does | Keep credentials and state changes in application code, and have a person confirm privileged actions | 1 |
| 2 | Sensitive Information Disclosure | Confidential or regulated data leaves through an answer, a log, a retrieved chunk or a side channel | Authorize inside the index query before retrieval, and keep secrets out of system prompts | 2 |
| 3 | Excessive Agency | Damaging actions run because the model has too many tools, permissions or freedom | Offer fewer tools with narrower functions, run them as the user and require approval for high-impact actions | 6 |
| 4 | Supply Chain | A model, dataset, adapter or conversion step is not what it claims to be | Vet suppliers, keep a signed inventory and use models only from verifiable sources | 3 |
| 5 | Data and Model Poisoning | Tampered data or model files plant backdoors, bias or weak spots | Track lineage, validate incoming data and set trust boundaries around RAG | 4 |
| 6 | Unbounded Consumption | Uncontrolled inference exhausts the service or the budget, or lets attackers clone a model | Token-aware rate limits, input size checks and hard spending caps | 10 |
| 7 | Misinformation | A wrong but credible answer is trusted and acted on | Ground claims in current sources and verify them before any high-impact action | 9 |
| 8 | Hidden Context Exposure | Hidden instructions, tool schemas or policy text are exposed or inferred | Keep sensitive data out of hidden context and enforce authorization outside the model | 7, as System Prompt Leakage |
| 9 | Vector and Embedding Weaknesses | The similarity-search layer leaks data across users or admits poisoned content | Enforce tenant scoping inside the index query and record where each embedding came from | 8 |
| 10 | Improper Output Handling | Model output reaches another component without validation or encoding | Treat the model like any other user: validate and encode its output, use parameterized queries | 5 |
One scenario, three fixes: the hijacked email assistant
OWASP's Excessive Agency entry walks through an email assistant. It has a tool that reads a user's mailbox so it can summarize incoming mail. The tool the developer chose can also send messages. An attacker emails the user a message that carries an indirect injection. The model follows it, scans the inbox for sensitive information and forwards it to the attacker's address.
Two entries meet in that story. The crafted email is prompt injection, the first entry. The damage comes from what the assistant was allowed to do, which is excessive agency. OWASP also lists rate limiting on the mail-sending interface as a way to reduce the damage. It names three ways to avoid the problem, each removing one of the three roots of excessive agency:
- Remove excessive functionality: use a tool that only reads mail.
- Remove excessive permissions: authenticate to the user's mail service with an OAuth session that has a read-only scope.
- Remove excessive autonomy: require the user to review and press send on every mail the tool drafts.
Scenario #1 of OWASP LLM03:2026, paraphrased, read on 6 November 2026.
Turn the list into a checklist for your app
Start from your own data flow, not from the list. OWASP's preface splits the work by what the model is. The list owns the risk when the model is a component inside your application. When the model becomes an actor, the risk moves to the OWASP Agentic Top 10. An actor has tools it can call, memory it carries between sessions and consequences it sets in motion downstream. The preface says to read both lists.
Numbers changed between editions, and tools lag. Excessive Agency was LLM06 in 2025 and is LLM03 now. Promptfoo's OWASP page, read on 6 November 2026, still describes the 2025 edition, and its shorthand such as owasp:llm:06 follows the 2025 numbers. Check which edition a scanner or a report means before you compare its findings with this table.
- Draw your app on one page: the inputs, the model, the tools it can call, where its output goes and what it stores.
- Go through the ten entries and mark each one applies, does not apply or unknown, with one line of why. An app with no tools has no use for the agency entry, and one with no vector store skips the embedding entry.
- For every entry that applies, copy its first fix from the table into your backlog and name the file or service where the control will live.
- Open the full entries for the three that worry you most and read their attack scenarios. Each entry lists the scenarios and the exact controls.
- Run a red team tool against the app and map each finding to an entry, as the next lesson shows.
Common mistakes
- Using 2025 numbers from an older article or a scanner preset next to the 2026 list.
- Reading the ten as ten separate problems. OWASP ties them together: prompt injection is the input-side compromise, and excessive agency decides what that compromise can do.
- Taking the rank as severity for your app. The ranking blends a practitioner vote with incident data, and it cannot know what your app does.
- Ticking off prompt injection because your model vendor reports a low attack rate. OWASP says defense is architectural.
- Skipping Unbounded Consumption as a cost problem. OWASP lists service disruption and model cloning in the same entry.
Try it yourself
- Pick one app you run or use and draw its inputs, tools and outputs on a single page.
- Give each of the ten a verdict and a one-line reason. Count the unknowns, since each one is a question to answer.
- Read the Excessive Agency entry in full if the model calls tools, or the Vector and Embedding entry if it uses retrieval.
- Choose one control from the table and write down where in your code it will be enforced.
Next: red team your own LLM app
A checklist tells you what to look for. The next lesson, red team your own LLM app, shows how to attack your own app with Promptfoo, garak and PyRIT, and how to read what they report.
Check yourself
Which risk climbed to third place in the 2026 OWASP list?
Show answer
D. Excessive Agency Excessive Agency rose to third, because the vote and the incident record agree that agentic deployments are where the damage is landing.
How did the 2026 list weigh the community vote against the incident data?
Show answer
B. Three-quarters vote, one quarter incident data The preface says the vote carries three-quarters of the weight and the incident data the remaining quarter.
In OWASP's hijacked email assistant, which fix removes excessive permissions?
Show answer
A. An OAuth session with a read-only scope for the user's mail service A read-only OAuth scope removes permissions. A read-only tool removes functionality, and the send button removes autonomy.
A scanner report says "LLM06 Excessive Agency". What should you check first?
Show answer
C. Which edition of the list the report follows Excessive Agency was LLM06 in 2025 and is LLM03 in 2026, and Promptfoo's OWASP page still follows the 2025 numbers.
Frequently asked questions
What is the OWASP Top 10 for LLMs?
It is a community-written ranking of the security risks that matter most for applications that use large language models. The 2026 edition checks the practitioner vote against a record of real incidents, and every entry carries examples, mitigations and attack scenarios.
Is the 2025 OWASP LLM Top 10 still valid?
OWASP lists it as an archived release and names the 2026 edition as current. Older articles and tool docs may still use its numbers, such as Excessive Agency as LLM06.
Who maintains the OWASP Top 10 for LLMs, and how do I report a mistake in it?
It is a core initiative of the OWASP GenAI Security Project, and the 2026 source lives in the GenAI-LLM-Top10 repository on GitHub. The repository welcomes corrections after release and points to an errata form for specific errors, broken links and mismatches with the published text.
Which OWASP LLM risk should I fix first?
Fix the entries your app meets, from the top. If the model calls tools, work on excessive agency early, because OWASP describes it as what gives an injection consequences outside the chat window.
Does the OWASP list cover RAG?
Yes, in several entries. Prompt Injection includes RAG repository poisoning as a scenario. Sensitive Information Disclosure says to authorize inside the index query. Data and Model Poisoning calls for trust boundaries around RAG. Vector and Embedding Weaknesses covers the similarity-search layer and says to enforce tenant scoping inside the index query.
Sources
- GitHub: OWASP GenAI LLM Top 10 2026, source folder https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/tree/main/2026/final
- GitHub: OWASP GenAI LLM Top 10 2026, preface https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM00_Preface.md
- GitHub: OWASP GenAI LLM Top 10 2026, LLM01 Prompt Injection https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM01_PromptInjection.md
- GitHub: OWASP GenAI LLM Top 10 2026, LLM03 Excessive Agency https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM03_ExcessiveAgency.md
- GitHub: OWASP GenAI LLM Top 10 repository README https://github.com/GenAI-Security-Project/GenAI-LLM-Top10
- GitHub: OWASP GenAI LLM Top 10, 2025 folder https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/tree/main/2025
- GitHub: OWASP Top 10 for LLM applications repository (legacy notice) https://github.com/OWASP/www-project-top-10-for-large-language-model-applications
- GitHub: Promptfoo, OWASP LLM Top 10 page https://github.com/promptfoo/promptfoo/blob/main/site/docs/red-team/owasp-llm-top-10.md