Lesson 8 of 8 · 7 min read
The OWASP Top 10 for LLM Applications
In this lesson
TL;DR: The 2026 list, in order: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Excessive Agency, LLM04 Supply Chain, LLM05 Data and Model Poisoning, LLM06 Unbounded Consumption, LLM07 Misinformation, LLM08 Hidden Context Exposure, LLM09 Vector and Embedding Weaknesses, LLM10 Improper Output Handling. The 2025 list has the same risks under other numbers (and calls LLM08 System Prompt Leakage), and both are still quoted, so always cite the year with the ID. Learn each by its mechanism and control, not as a list to recite: interviewers check whether you can apply it to a design.
Before you read
Pick an answer before you read further. The lesson below explains it, and guessing first, right or wrong, helps the explanation stay with you.
1Which two OWASP LLM risks most often combine to turn a prompt injection into a data breach?
The ten, by mechanism
| 2026 | 2025 | Risk | Mechanism | Example | Primary control |
|---|---|---|---|---|---|
| LLM01 | LLM01 | Prompt Injection | Text from others, in any modality, is followed as instructions | A web page redirects a browsing agent | Limit what a fooled model can reach and do |
| LLM02 | LLM02 | Sensitive Information Disclosure | Data in context or training leaks through output | Another user's record appears in an answer | Authorization before retrieval; data minimisation |
| LLM03 | LLM06 | Excessive Agency | Too much functionality, permission or autonomy | Agent with full mailbox scope | Narrow tools, user-scoped tokens, gated actions |
| LLM04 | LLM03 | Supply Chain | Compromised models, datasets, libraries or plugins | A model file executes code when loaded | Provenance, signing, safe formats, vetted sources |
| LLM05 | LLM04 | Data and Model Poisoning | Training or tuning data manipulated | A backdoor triggers on a phrase | Dataset provenance, filtering, evaluation for triggers |
| LLM06 | LLM10 | Unbounded Consumption | Expensive requests exhaust budget or capacity | Agent loops run up costs | Quotas, token and step limits, budgets |
| LLM07 | LLM09 | Misinformation | Confident wrong output trusted by people or systems | Fabricated policy acted on | Grounding, citations, human review where it matters |
| LLM08 | LLM07 | Hidden Context Exposure | Instructions, tool definitions or other hidden context disclosed | Credentials in a prompt | Keep secrets and access rules out of the context |
| LLM09 | LLM08 | Vector and Embedding Weaknesses | Retrieval stores leak, mix tenants or get poisoned | Cross-tenant chunks retrieved | Per-tenant isolation, permission-aware retrieval |
| LLM10 | LLM05 | Improper Output Handling | Model output passed unchecked to interpreters | Output rendered as HTML runs script | Encode and validate output; safe rendering |
The 2026 edition was ranked by combining a corpus of real incidents (7,714 collected, 6,639 classifiable) with a practitioner vote weighted at three quarters. Prompt injection stayed first on the vote even though raw incident counts would have dropped it from the top ten, and Excessive Agency rose to third as agents with tools spread.
How the items connect
The list is not ten independent problems. Most incidents combine an entry (injection, poisoning, supply chain) with an impact (disclosure, unsafe output handling, excessive agency, unbounded consumption). Hidden context exposure and vector and embedding weaknesses are usually about designs that put the wrong things in the wrong place: secrets in prompts, unfiltered data in indexes. Misinformation is the risk that people or downstream systems trust output they should verify.
LLM01 Injection
LLM application
Model + context + tools
LLM02 Disclosure
Also in the picture
LLM05 Poisoning
LLM04 Supply chain
LLM10 Output
LLM03 Agency
An entry gives the attacker influence
Injection, poisoned data or a compromised component lets an attacker shape what the application does.
That framing has a practical payoff. You cannot close every entry, especially prompt injection, but you can design the impacts: authorization before retrieval, safe output handling, narrow tools and budgets. Those controls work whichever entry the attacker uses.
Why the 2026 list moved
The 2026 edition's preface explains its changes, and the reasons are better interview material than the order itself:
- Excessive Agency rose to third, described by the preface as the most consequential move on the list, because agents are where model failures turn into actions.
- Unbounded Consumption rose four places, from tenth to sixth, reflecting cost exhaustion, reasoning-token abuse and agent loops. It now also contains model extraction and distillation, which used to be a separate "model theft" entry.
- Improper Output Handling fell from fifth to tenth. Not because it matters less, but because much of the damage now lands through agent actions, counted under Excessive Agency; the entry also now covers insecure code generated by assistants.
- Sensitive Information Disclosure held second, the placement the authors were most confident about.
- Misinformation sat near the bottom in the community vote and near the top in incident data, and was placed in the middle.
- System Prompt Leakage became Hidden Context Exposure (LLM08:2026) and broadened to retrieved policy text and tool schemas; memory and inter-agent channels are left to the Agentic list.
How the ranking was built. Three quarters of each entry's weight came from a vote of practitioners and one quarter from incident data. The preface notes that prompt injection would drop out of the top ten on raw incident counts alone, because mature teams block attacks before they reach public databases (a "defence effect"), and that the quarter weight can move an entry about one tier where belief and evidence disagree. When someone treats the list as a frequency ranking, that is the correction.
Mappings. Appendix A of the 2026 edition maps each entry to nine other frameworks, including the OWASP Agentic Top 10, MITRE ATLAS tactics, CWE, NIST AI 600-1 and the NIST AI RMF; for example, prompt injection maps to ATLAS's initial-access tactic and unbounded consumption to its impact and exfiltration tactics. ISO/IEC 42001 is not mapped, and no official crosswalk to the 2025 list is published.
Worked example: writing a finding with the list
A customer chatbot sends requests containing restricted personal data through a gateway whose fallback, on a timeout, routes them to a second provider without a zero-data-retention agreement.
| Field | Entry |
|---|---|
| Primary classification | LLM02:2026 Sensitive Information Disclosure (the impact) |
| Contributing | LLM04:2026 Supply Chain (third-party provider terms changed by routing) |
| ATLAS tactic (via Appendix A) | Exfiltration |
| NIST AI 600-1 risk | Data Privacy |
| Decision | Fail closed for the restricted class; fallback allowed for the internal class only |
The finding shows the list working as intended: shared vocabulary with a year on every ID, a mapping to other frameworks, and a decision rather than a tick. Note that a gateway design flaw maps cleanly even though no entry's text mentions gateways.
- 1
1 · LLM03:2026 Excessive Agency
up from 6th in 2025
- Agents are where failures become actions
- The most consequential move
Answer with tool limits, not prompts
- 2
2 · LLM06:2026 Unbounded Consumption
up from 10th
- Cost exhaustion and reasoning loops
- Absorbs model extraction
Answer with money-based caps
- 3
3 · LLM08:2026 Hidden Context Exposure
was System Prompt Leakage
- Covers tool schemas and retrieved policy
- Memory moves to the Agentic list
Answer: hidden context is not secret
- 4
4 · LLM10:2026 Improper Output Handling
down from 5th
- Damage now often counted under agency
- Includes generated code
Still the impact half of many chains
What rose
Agency and consumption rose because agents and reasoning made actions and costs the place damage lands.
Using the list well
- As a review checklist, walk a design through each item and record a decision, not just a tick.
- As shared vocabulary, cite the ID with its year in findings (LLM03:2026) so engineers can look up the right guidance.
- Not as a complete threat model. It omits classic risks (authentication, infrastructure) and agent-specific depth. OWASP's separate Top 10 for Agentic Applications (December 2025) and MITRE ATLAS complement it; see MITRE ATLAS versus ATT&CK.
- Check the edition. The 2025 numbering is still on OWASP's own landing page and in most courses, and the 2023 list used names such as Insecure Output Handling and Model Theft. An ID without a year is ambiguous.
Misconceptions interviewers listen for
- "LLM07 is system prompt leakage." Only in the 2025 list; in 2026 LLM07 is Misinformation and leakage is LLM08 Hidden Context Exposure, with a broader scope.
- "The ranking is by how often each risk happens." Three quarters of the weight is a practitioner vote.
- "Improper output handling matters less now." It fell in rank but remains the impact step in many chains, and now includes generated code.
- "The LLM list covers agents." Agent-specific risks are scoped to the separate Agentic Top 10.
- "Model theft disappeared." Extraction and distillation sit inside LLM06:2026.
What if · interview follow-ups
Hold your answer as the constraints change
Your CISO asks you to brief the security team on the OWASP Top 10 for LLM Applications 2026 and how to use it in reviews. The interviewer pushes on your understanding.
Start here
What if a colleague's report cites 'LLM07' with no year?
Which risk was LLM07 in each edition?
It is ambiguous: LLM07 was System Prompt Leakage in 2025 and is Misinformation in 2026. Require the year on every ID (LLM07:2025 or LLM07:2026), and for old reports map 2025 IDs to the 2026 list by name, since no official crosswalk is published.
Carry it forwardA list identifier without an edition is not a reference.
Weak answerAssuming the numbering is stable across editions.
Constraint changes
What if someone argues prompt injection should not be first because incident data shows few cases?
How was the ranking built, and what is the defence effect?
The ranking weights the practitioner vote three to one over incident data, and the preface notes that prompt injection would fall on raw incident counts partly because mature teams block attacks before they reach public databases. Low reported incidents can reflect detection and disclosure bias, not low risk.
Carry it forwardKnow the methodology before arguing about the order.
Weak answerTreating the list as a measured frequency ranking.
Constraint changes
What if a gateway's silent fallback leaks restricted data to a second provider; how do you classify it?
Which entry is the impact, and which is the cause?
LLM02:2026 Sensitive Information Disclosure for the impact, with LLM04:2026 Supply Chain contributing because routing changed the third-party terms; map to the ATLAS exfiltration tactic through Appendix A and to the data-privacy risk in NIST AI 600-1, and record the decision to fail closed for that data class.
Carry it forwardClassify by impact, note contributing causes, and map to other frameworks for the audience that needs them.
Weak answerLeaving it unclassified because no entry mentions gateways.
Constraint changes
What if the review is of an agent with tools and memory?
Which list covers agent-specific risks?
Use the LLM list for the model-facing risks and the OWASP Agentic Top 10 for tool misuse, identity and privilege abuse, memory poisoning, inter-agent communication and cascading failures; the 2026 LLM list explicitly scopes those agentic risks out.
Carry it forwardUse the list whose scope matches the system you are reviewing.
Weak answerForcing every agent risk into LLM03 Excessive Agency.
Constraint changes
What if the CISO wants to declare the product 'OWASP Top 10 compliant'?
Is the list a standard you can comply with?
No: it is an awareness and prioritisation list, not a requirements standard. Offer instead a review record showing each entry was considered with a decision and evidence, and point to standards meant for verification, such as OWASP's AI security verification work, or regulatory and management-system frameworks for compliance claims.
Carry it forwardUse top-ten lists to prioritise and communicate, not to certify.
Weak answerWriting 'compliant with the OWASP Top 10' in a customer document.
Now defend it
As the defender, how would you use the list to track risk across products?
Tag every finding with year-qualified IDs and the mapped ATLAS tactic, report open findings per entry and product, track which entries have decisions and evidence for each system, re-map when a new edition is published, and pair the LLM list with the Agentic list for agent features.
How this shows up in interviews
"Walk through the OWASP LLM Top 10" appears as a knowledge check, and listing the names is the weak half of the answer. The strong half is applying it: pick a system the interviewer describes and say which three items matter most and why, then name the control for each.
Say it in 30 seconds: "The 2026 OWASP LLM Top 10 is prompt injection, sensitive information disclosure, excessive agency, supply chain, data and model poisoning, unbounded consumption, misinformation, hidden context exposure, vector and embedding weaknesses and improper output handling; the 2025 edition numbers them differently, so I always give the year. I think of it as entries, like injection and poisoning, combining with impacts, like disclosure, unsafe output and excessive agency. I can't close every entry, so I design the impacts: authorization before retrieval, safe output handling, narrow tools and budgets."
Check yourself
Say or write your answer first, then reveal. Explaining it from memory, in your own words, is the skill an interviewer is checking.
1A team's review marks prompt injection (LLM01:2026) 'mitigated' because they added an input classifier. What would you change in the review?
2How is the 2026 OWASP LLM ranking weighted between practitioner vote and incident data?
3Why did Improper Output Handling drop from fifth to tenth in 2026?