Ten security risks, ranked by the people who build and break these systems for a living — and, for the first time in 2026, checked directly against a real record of what has actually gone wrong. This is the starting point for understanding LLM security, and the natural first step before the deeper OWASP Agentic Top 10.
The OWASP Top 10 for LLM Applications is a community-maintained ranking of the ten most critical security risks facing applications built on large language models — a shared vocabulary for threat modeling, red teaming, and control design, maintained by OWASP's GenAI Security Project. It's the older, foundational sibling of the OWASP Agentic Top 10, and understanding it first makes the agentic framework make a lot more sense.
Every prior edition of this list ran entirely on practitioner judgment — hundreds of security professionals voting on what worried them most. The 2026 edition did something new: it tested that vote against a corpus of 7,714 real incidents pulled from public vulnerability databases and an AI-harm database, building classifiers to sort the 6,639 that carried enough detail to categorize. Then it asked one direct question: does what practitioners fear match what the incident record actually shows?
The answer, in the project leads' own words, was no, not always — and the disagreements turned out to be more informative than the agreements.
Prompt Injection is voted the #1 risk by practitioners — but ranked purely by raw incident count, it falls out of the top 10 entirely. OWASP's own explanation: this is a "defense effect." Teams fight injection so hard that fewer clean exploits ever reach a public database, which means the low incident count actually understates the real risk mature teams are already spending real money holding off, not evidence the risk is small. It stays at #1.
Misinformation ran the opposite direction — voted near the bottom by practitioners, but the incident record placed it near the top, the widest gap in the direction that actually matters. When a model's fluent, confident output drives a decision or a tool call, a wrong answer becomes a wrong action — and the record shows that happening more often than the vote assumed. The final list weighted the practitioner vote at 75% and the incident evidence at 25%, enough to move Misinformation up without letting one year of data override community judgment outright.
| 2026 Rank | Risk | Movement |
|---|---|---|
| LLM01 | Prompt Injection | Held #1 |
| LLM02 | Sensitive Information Disclosure | Held #2 |
| LLM03 | Excessive Agency | Jumped from #6 — the single biggest, most consequential move on the list |
| LLM04 | Supply Chain | Moved |
| LLM05 | Data and Model Poisoning | Moved |
| LLM06 | Unbounded Consumption | Rose 4 places |
| LLM07 | Misinformation | Moved up, driven by real incident evidence |
| LLM08 | Hidden Context Exposure | Renamed and broadened from "System Prompt Leakage" |
| LLM09 | Vector and Embedding Weaknesses | Moved |
| LLM10 | Improper Output Handling | Fell from #5 — the furthest drop on the list |
Excessive Agency's climb to third is the one worth sitting with: it reflects that both practitioner judgment and the incident record agree that agentic deployments — models with tools, memory, and real downstream consequences — are where the actual damage is landing right now, not a theoretical future concern.
A model can't architecturally tell the difference between an "instruction" and "data" — both are just tokens in the same stream. That means input that changes the model's behavior in unintended ways can arrive not just from a user typing something malicious, but from a retrieved document, an email, a tool's own output, or even an image or audio clip. Indirect prompt injection — where the attacker never talks to the model directly, but plants content somewhere the model will read it later — is the more dangerous variant, because the user never sees the instruction at all.
Real example: EchoLeak, a zero-click vulnerability disclosed against Microsoft 365 Copilot — a single crafted email caused the assistant to exfiltrate organizational data with no user interaction at all, bypassing both the deployed prompt-injection classifier and a link-redaction filter.
A model can leak confidential or regulated data through more channels than just its final answer — reasoning traces, tool-call arguments, embeddings, even measurable properties like response timing or token length can all disclose something a user was never authorized to see.
Real example: a 2023 "divergence attack" against a production ChatGPT model cost roughly $200 in queries and extracted over 10,000 unique memorized training examples, including real, verbatim personal data.
When a model can call tools, it can also be manipulated into misusing them — not because the tool is insecure, but because the model was given more functionality, more permission, or more autonomy than its actual job requires. The fix isn't smarter model behavior; it's giving the agent narrower, tightly-scoped capabilities in the first place.
Real example: an email-summarizing assistant, given a tool that could also send mail (functionality it never needed), was manipulated by an indirect prompt injection into scanning the user's inbox for sensitive information and forwarding it to the attacker — a textbook combination of excessive functionality and excessive autonomy.
LLM applications depend on far more than application code — pre-trained models, fine-tuned adapters, datasets, and conversion pipelines all carry the same tampering risk as any traditional software dependency, but they're harder to inspect and easier to poison invisibly.
Real example: a malicious npm package named postmark-mcp impersonated the legitimate one and secretly BCC'd every processed email to an attacker — affecting an estimated 300 organizations before it was caught.
Poisoning targets the model's actual learning process, not a single runtime bug — which means it often can't be patched, only detected and retrained around. As few as 250 poisoned documents have been shown to compromise models from 600M to 13B parameters, regardless of how large the overall training set was.
Real example: researchers modified a model's chat template with trigger-activated conditional instructions and redistributed it through a public hub — factual accuracy dropped from 90% to 15% specifically when the trigger condition was present, while the model behaved completely normally otherwise.
LLM inference is expensive, and attackers can trigger disproportionately costly computation at almost no cost to themselves — a genuine cost asymmetry. This covers everything from simple denial-of-service flooding to a subtler, newer problem: prompts specifically crafted to push reasoning models into long, expensive "thinking" loops.
Real example: in a long-running agentic session, per-turn cost can climb from roughly $0.001 on the first turn to about $0.50 by turn 100 purely from accumulating context — no single request ever triggers a rate limit, since each one stays individually within budget, but the aggregate across many concurrent sessions can reach hundreds of dollars.
A model producing confident, fluent, but wrong output is a system-level failure the moment that output drives a real decision, a tool call, or an automated workflow — not just an accuracy problem. This is the category the real incident data pushed up hardest this year, precisely because overreliance on confident-sounding output is often quietly built into agentic system design itself.
Real example: a coding assistant recommends a plausible but entirely non-existent software package — and attackers have started pre-registering exactly these hallucinated package names in advance, so a developer who trusts the suggestion installs genuinely attacker-controlled code.
System prompts and other hidden, non-user-facing context should never be treated as a secret — the safest design assumption is that hidden context is discoverable, and that nothing security-critical should ever depend on it staying hidden. This entry was renamed and broadened this year from "System Prompt Leakage" specifically because the real risk extends well beyond just the prompt itself — tool schemas, permission logic, and formatting rules are all part of the same exposure surface.
Real example: a system prompt containing embedded tool credentials was leaked to an attacker, who then reused those same credentials directly — the actual vulnerability wasn't the leak itself, it was that credentials were ever placed somewhere the model could see them in the first place.
Any system that turns content into numerical embeddings for similarity search — RAG being the most common case — has a genuinely distinct attack surface based on the geometry of that embedding space, separate from prompt injection entirely. Some of these attacks work even when the retrieved content contains no malicious instructions whatsoever.
Real example: stored embeddings can be inverted back into their original source text — some methods achieve up to 92% exact reconstruction of short text from the embedding alone, meaning a leaked "embeddings-only" backup should be treated as equivalent to a full document breach, not a lesser one.
Model output that gets passed downstream without proper validation is functionally similar to giving a user indirect access to whatever that downstream system can do — this is the category that produces classic web vulnerabilities (XSS, SQL injection, remote code execution) once you realize the "input" triggering them can be entirely LLM-generated. This dropped the furthest of any category this year, from 5th to 10th, as the community's understanding of it matured into a narrower, better-defended surface.
Real example: a website-summarizer tool processes a page containing a hidden prompt injection instructing the model to capture sensitive conversation content — the model then encodes that data and sends it to an attacker-controlled server, entirely because its output was passed downstream with no validation or filtering at all.
OWASP states this boundary directly, in the project leads' own words:
This list owns the risk when the model is a component inside your application. The moment that model becomes an actor, with tools it can call, memory it carries between sessions, and consequences it sets in motion downstream, the risk moves to the OWASP Agentic Top 10.
In practice: if your system is a model answering questions or generating content within an application, the LLM Top 10 is the right framework, start to finish. If it plans, remembers across sessions, chooses and calls its own tools, or takes real actions with real consequences, the OWASP Agentic Top 10 is where the deeper risk actually lives. Many real systems need both — a feature that started as a simple LLM integration and grew into something that acts on its own doesn't stop needing LLM Top 10 coverage just because it also needs the Agentic framework on top.
The OWASP Agentic Top 10 was published December 9, 2025 — before this 2026 LLM Top 10 existed — so its own text cites the 2025 LLM Top 10 numbering (for example, "Excessive Agency (LLM06:2025)"). This guide covers the current, live 2026 version, where Excessive Agency moved to LLM03. Both citations are accurate for what they're referencing; the numbering shift is simply a real consequence of the LLM Top 10 being updated after the Agentic Top 10 was already published. If you see "LLM06:2025" in Agentic Top 10 material and "LLM03:2026" here, both are correct — they're pointing at the same risk category under two different editions.