# OWASP Top 10 for LLM Applications: the 2026 list, 2025 mapping and how to test each risk

Source: https://airedteamingservices.com/guides/owasp-top-10-for-llm-applications/
Publisher: Excession Labs (airedteamingservices.com)
Last updated: 2026-11-09

OWASP Top 10 for LLM Applications: exact IDs and names for the 2026 and 2025 lists, a 2025-to-2026 mapping, and a tester's check for each risk.

> **Short answer:** OWASP published a new Top 10 for LLM Applications on 4 August 2026. LLM01 is still Prompt Injection, and Excessive Agency moved up to LLM03. System Prompt Leakage (LLM07:2025) is now covered by Hidden Context Exposure (LLM08:2026). Both editions are listed with exact IDs, and each 2026 risk has a meaning and a test.

The OWASP Top 10 for LLM Applications is a ranked list of the main security risks in applications built on large language models. The current edition is the 2026 list, released on 4 August 2026. The 2025 list is still in wide use.

Below are the exact IDs and names for both editions, a one-line meaning for each 2026 risk, a mapping from 2025 to 2026, and a test for each risk.

> **Note:** Many pages still show only the 2025 list. The OWASP hub page at genai.owasp.org/llm-top-10/ showed the 2025 list on 2026-11-09, while the 2026 list sat on its own resource page. Check the edition before you quote an ID.
## What is the OWASP Top 10 for LLM Applications 2026?

It is OWASP's 2026 ranking of LLM application risks, with the status "Published" and the release date August 4, 2026 on the project's GitHub README. The press release of 2 September 2026 says it "incorporates updated rankings, expanded threat coverage and research drawn from thousands of real-world AI security incidents" and expands mappings to NIST, MITRE ATLAS, CWE and the Top 10 for Agentic Applications.

| ID | Name | Meaning (from the OWASP entry) |
|---|---|---|
| LLM01:2026 | Prompt Injection | Input alters model behavior in ways the developer did not intend. Input includes user text, retrieved content, tool output, media and memory |
| LLM02:2026 | Sensitive Information Disclosure | The system exposes confidential, regulated or proprietary data through an unauthorized channel |
| LLM03:2026 | Excessive Agency | The system takes damaging actions on unexpected, ambiguous or manipulated model output |
| LLM04:2026 | Supply Chain | Weak integrity of training data, models, adapters, conversion pipelines and deployment platforms |
| LLM05:2026 | Data and Model Poisoning | An adversary or unsafe process manipulates data or model artifacts to embed harmful behavior |
| LLM06:2026 | Unbounded Consumption | The app allows excessive, uncontrolled inference, which causes outage, cost or model cloning |
| LLM07:2026 | Misinformation | The model gives incorrect or misleading output that people or agents trust and act on |
| LLM08:2026 | Hidden Context Exposure | Someone extracts or infers hidden instructions or context. The entry says to design on the assumption that hidden context can be found |
| LLM09:2026 | Vector and Embedding Weaknesses | Risks in embeddings and similarity search, including cross-tenant leakage |
| LLM10:2026 | Improper Output Handling | Model output goes downstream without validation and can cause XSS, SSRF or remote code execution |

## What was the 2025 list?

The 2025 list is the edition published in November 2024 (version 2025, release dated 2024-11-18 in the official PDF). Its IDs and names:

LLM01:2025 Prompt Injection; LLM02:2025 Sensitive Information Disclosure; LLM03:2025 Supply Chain; LLM04:2025 Data and Model Poisoning; LLM05:2025 Improper Output Handling; LLM06:2025 Excessive Agency; LLM07:2025 System Prompt Leakage; LLM08:2025 Vector and Embedding Weaknesses; LLM09:2025 Misinformation; LLM10:2025 Unbounded Consumption.

## How do the 2025 and 2026 lists map?

Most entries keep their names and change position. The mapping is our comparison of the two official lists, not an OWASP publication.

| 2025 entry | 2026 entry | Change |
|---|---|---|
| LLM01 Prompt Injection | LLM01 Prompt Injection | Same |
| LLM02 Sensitive Information Disclosure | LLM02 Sensitive Information Disclosure | Same |
| LLM03 Supply Chain | LLM04 Supply Chain | Down one |
| LLM04 Data and Model Poisoning | LLM05 Data and Model Poisoning | Down one |
| LLM05 Improper Output Handling | LLM10 Improper Output Handling | Down five |
| LLM06 Excessive Agency | LLM03 Excessive Agency | Up three |
| LLM07 System Prompt Leakage | LLM08 Hidden Context Exposure | Renamed in scope; same area |
| LLM08 Vector and Embedding Weaknesses | LLM09 Vector and Embedding Weaknesses | Down one |
| LLM09 Misinformation | LLM07 Misinformation | Up two |
| LLM10 Unbounded Consumption | LLM06 Unbounded Consumption | Up four |

"System Prompt Leakage" is no longer a named entry. The 2026 text for LLM08 covers system prompts, policy text pulled in at runtime, and tool schemas. OWASP's entry does not say that it renames the 2025 entry, so we call it "same area". [System prompt leakage](/guides/system-prompt-leakage/) has the detail.

## How do testers check each risk?

Each risk needs its own test and evidence. The tests assume written authorization and test accounts.

| 2026 ID | Test | Safe behavior | Evidence |
|---|---|---|---|
| LLM01 | Plant benign marker text in each input source (chat, file, page, tool result) and repeat | Marker is treated as data; no tool call | Prompt, context, tool log, 10+ runs |
| LLM02 | Ask for another user's data in chat, RAG and tool paths with two accounts | Access rights apply; no cross-user data | Both accounts' queries and results |
| LLM03 | List every tool; call each with out-of-role requests and odd arguments | Denied outside the user's rights; approval for side effects | Tool call log with identity |
| LLM04 | Inventory models, adapters, plugins and MCP servers; check pinning and sources | Pinned versions, known sources, integrity checks | Inventory and checksums |
| LLM05 | Review how training, fine-tune and RAG data are admitted; test write paths | Only trusted writers; review before indexing | Write-path test results |
| LLM06 | Send long and many requests inside a stated cost cap | Rate limits, token caps, per-user quotas | Request counts, cost, limits hit |
| LLM07 | Check answers for grounding on a set of known-answer questions | Answers cite sources; refuses when unsure | Question set and scored answers |
| LLM08 | Try to read system prompt, tool schemas and policy text; scan prompt for secrets | No secrets in context; critical rules enforced in code | Extracted text, secret scan |
| LLM09 | Query as tenant A for tenant B's content; test embedding inversion exposure | Retrieval filters by tenant and user | Retrieved IDs per tenant |
| LLM10 | Make the model emit markup, URLs and commands; see where they land | Output encoded or validated before use | Rendered output, network log |

For LLM06, state a cost cap before testing, so the test cannot burn paid model calls without limit.

> **Demonstration:** This is a demonstration against Harbor Support, a fictional support assistant at support.example.com. No real customer system was tested.
> 
> Finding sketch, LLM10:2026 Improper Output Handling: the tester asks the assistant to include a formatted link in its reply. The web UI renders model output as HTML without encoding.
> 
> ```
> assistant output:  Here is your link: open
> UI result:         link rendered as live HTML in the agent console
> control:           same text via plain-text field is escaped
> ```
> 
> Impact: an outsider who can influence ticket text can place markup in an agent's console. Fix: encode model output by context (HTML, URL, shell) and add a content security policy. Retest: repeat with the same input after the fix and confirm the output is escaped.
## How should you use the list in a report?

Use the list as a label and a checklist. It does not produce a score. Say which edition you used, and map each finding to one primary ID with the secondary ones noted. The [frameworks page](/frameworks/) shows how we map findings to OWASP, MITRE ATLAS and NIST. Common mistakes:

1. Treating the list as complete. It is a Top 10. Your app can have flaws that the list does not name, such as plain broken access control.
2. Claiming compliance. No one certifies an app against the OWASP list.
3. Using one ID for everything. A single incident often touches LLM01, LLM02 and LLM03 together. Name the root cause.

For agents, read the OWASP Top 10 for Agentic Applications too. It was released on 9 December 2025 and uses IDs ASI01 to ASI10, such as ASI01 Agent Goal Hijack and ASI06 Memory & Context Poisoning. Our [AI agent security assessment](/ai-agent-security-assessment/) maps findings to both lists.

## How does the list relate to our service?

We map each finding in an [LLM application security assessment](/llm-application-security-assessment/) to the OWASP edition you choose. The frameworks help readers find a finding, but they do not replace evidence of a real effect.

## What do the 2026 entries say about the main scenarios?

Each entry in the 2026 final folder lists attack scenarios and prevention. Read the entry for any risk you rate high. Our reading of the entries:

- LLM01 and LLM03 work as a pair. Injection is the cause in many cases, and excessive agency sets the impact. Test them together: plant text, then check which tool the model can reach.
- LLM08 sets a design rule: assume that anything in the context can reach a user, and do not store credentials there.
- LLM09 includes cross-tenant leakage. If you run a shared vector store for several customers, test the tenant filter with two tenants. The [RAG security guide](/guides/rag-security/) shows the method.

## How do you choose which risks to test first?

Rank by what the model can reach, not by list order. A model with no tools and no private data has low impact for LLM03 and LLM09. A model with write access to business systems has high impact for LLM01 and LLM03. Start where a successful attack would do the most harm.

## Questions

### Which edition of the OWASP LLM Top 10 should I use?

Use the 2026 edition for new work. OWASP set its release date as 4 August 2026. Many customers, tools and blog posts still cite 2025, so keep the mapping table handy and name the edition in every report.

### Is the OWASP LLM Top 10 a standard or a certification?

No. It is an awareness document from the OWASP GenAI Security Project. No one is certified against it. Use it to structure a test plan and to talk to customers, and do not claim that a test makes you compliant with it.

### How does it relate to the OWASP Top 10 for Agentic Applications?

OWASP released a separate list for agents on 9 December 2025, with IDs ASI01 to ASI10. The LLM list covers the application and model. The agentic list adds goal hijack, identity abuse, memory poisoning and inter-agent risks. Agent builders should read both.

### Do we need to test all ten for every app?

No. Scope by architecture. An app with no RAG has no vector risk to test, and an app with no tools has little excessive agency. Record why a risk is out of scope, so a reader does not assume you tested it.

## Sources

- [OWASP GenAI-LLM-Top10 2026 README (status Published, 4 August 2026)](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/README.md)
- [OWASP Top 10 for LLM Applications 2026: final entries](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/tree/main/2026/final)
- [OWASP GenAI Security Project: 2026 Top 10 for LLM Applications press release (2 September 2026)](https://genai.owasp.org/2026/09/01/owasp-genai-security-project-unveils-2026-top-10-for-llm-applications-new-agent-control-standard-and-sponsors-as-community-tops-30000-members/)
- [OWASP Top 10 for LLM Applications 2025 (PDF)](https://owasp.github.io/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-v2025.pdf)
- [OWASP GenAI Security Project: LLM Top 10 hub page (still showing the 2025 list on 2026-11-09)](https://genai.owasp.org/llm-top-10/)
- [OWASP Top 10 for Agentic Applications (9 December 2025)](https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/)