TL;DR: The current edition is the 2026 list (published early August 2026): LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Excessive Agency, LLM04 Supply Chain, LLM05 Data and Model Poisoning, LLM06 Unbounded Consumption, LLM07 Misinformation, LLM08 Hidden Context Exposure (formerly System Prompt Leakage), LLM09 Vector and Embedding Weaknesses, LLM10 Improper Output Handling. The 2025 list used different numbers for most entries and both are still cited, so always say the year with the ID. Give a concrete example and a control for each, then show you can use the list: group entries and impacts, and pick the three that matter for the system in front of you.
How to approach it
Name the edition first, because "LLM03" means Supply Chain in 2025 and Excessive Agency in 2026. Move through the list briskly with one example and one control each, then add structure. If the interviewer described a system earlier, apply the list to it; that is the real test.
A strong answer
- 1
1 · Input and context
LLM01 Prompt Injection · LLM08 Hidden Context Exposure
- Text that steers the model; prompts and context that leak
- 2
2 · Data
LLM02 Sensitive Info Disclosure · LLM05 Data and Model Poisoning
- What goes in, what comes out
- 3
3 · Retrieval
LLM09 Vector and Embedding Weaknesses
- Index permissions, poisoning, inversion
- 4
4 · Actions and outputs
LLM03 Excessive Agency · LLM10 Improper Output Handling
- What the model can do and where output goes
- 5
5 · Platform and operations
LLM04 Supply Chain · LLM06 Unbounded Consumption · LLM07 Misinformation
- Dependencies, cost, overreliance
| 2026 ID | Name | 2025 ID | One-line example | Control |
|---|---|---|---|---|
| LLM01 | Prompt Injection | LLM01 | A support ticket tells the triage agent to close all tickets | Bound what the agent can do; mark untrusted input |
| LLM02 | Sensitive Information Disclosure | LLM02 | An answer quotes another customer's address | Authorization before retrieval; minimise context |
| LLM03 | Excessive Agency | LLM06 | An agent's token can read every mailbox | Narrow tools, user-scoped tokens, gated actions |
| LLM04 | Supply Chain | LLM03 | A downloaded model file runs code on load | Safe formats, pinned and signed artifacts |
| LLM05 | Data and Model Poisoning | LLM04 | Planted web pages bias a model or implant a trigger | Dataset provenance, filtering, trigger testing |
| LLM06 | Unbounded Consumption | LLM10 | A looping agent runs up a large bill | Quotas, step and token limits, budgets |
| LLM07 | Misinformation | LLM09 | An assistant invents a refund policy that staff follow | Grounding, citations, review for high-stakes use |
| LLM08 | Hidden Context Exposure | LLM07 (System Prompt Leakage) | A leaked prompt or tool definition contains an API key | Keep secrets and access rules out of the context |
| LLM09 | Vector and Embedding Weaknesses | LLM08 | Tenant A's question retrieves tenant B's chunks | Per-tenant isolation, permission-aware retrieval |
| LLM10 | Improper Output Handling | LLM05 | Model output rendered as HTML runs script | Output encoding, validation, safe rendering |
How the 2026 list was ranked. According to the edition's preface, the project assembled 7,714 real incidents and classified the 6,639 with enough detail, then combined that data with a practitioner vote that carries three quarters of the weight. On incident counts alone prompt injection would have fallen out of the top ten; it stayed first on the vote and on the argument that heavy defensive investment suppresses its incident numbers. Excessive Agency rose to third, which tracks the shift from chat assistants to agents with tools. The rename to Hidden Context Exposure widens the old item from the system prompt to anything in the context the user is not meant to see, such as tool definitions and retrieved snippets.
Structure. Most incidents pair an entry (Prompt Injection, Supply Chain, Poisoning) with an impact (Sensitive Information Disclosure, Excessive Agency, Improper Output Handling, Unbounded Consumption). Prompt injection cannot be closed, so the impact-side controls carry the load. Hidden Context Exposure and Vector and Embedding Weaknesses are usually design placement errors; Misinformation is about over-trust.
Application. For a customer-facing RAG chatbot with no tools, the top three are prompt injection through retrieved content, disclosure through retrieval scope, and output handling in the browser. For an internal agent with tools, Excessive Agency rises to the top.
What interviewers probe next
- "Why is prompt injection still first if incidents don't show it most?" The ranking weights practitioner judgement at 75 percent, and the edition argues incident data undercounts it because every model reading untrusted input is exposed and teams spend heavily to suppress it. Frequency in a dataset is not the same as systemic risk.
- "What does the list miss?" Classic security (authentication, infrastructure), and agent depth, which OWASP's separate Top 10 for Agentic Applications (December 2025) addresses with risks such as goal hijack, tool misuse and memory poisoning.
- "Which item is most often misunderstood?" Improper Output Handling: people think about inputs and forget the output reaches interpreters.
What if?
What if · interview follow-ups
Hold your answer as the constraints change
Your security team wants to use the OWASP Top 10 for LLM Applications (2026 edition) to review a new support assistant that retrieves from internal documents and can issue refunds.
Start here
Which entries would you check first for an assistant with tools?
Which entries combine into a path from outside text to a refund?
Start with LLM01 Prompt Injection, because retrieved documents and tickets carry outside text, and LLM03 Excessive Agency, because the refund tool decides impact. Then LLM10 Improper Output Handling, since output reaches a browser and possibly other systems. Those three together describe the main path from untrusted text to a harmful action, so they set the priority.
Carry it forwardPrioritise entries that chain into a real impact.
Weak answerWorking through all ten in numerical order with equal effort.
Constraint changes
What if the assistant uses a vector index over company documents?
Who can read from and write to the index?
LLM09 Vector and Embedding Weaknesses applies: permission checks at retrieval, tenant separation in the index, who can write to it, and whether embeddings are protected as copies of the data. LLM05 Data and Model Poisoning overlaps if anyone can add documents that later steer answers. Ask how deletions and sharing changes reach the index.
Carry it forwardAn index is a data store with its own access rules.
Weak answerTreating the vector store as an anonymised cache.
Constraint changes
What if the system prompt contains internal details?
Was the 2025 name of this entry different?
That is LLM08 Hidden Context Exposure, which the 2025 list called System Prompt Leakage. The risk is not the leak itself but what the hidden context contains: credentials, internal URLs or access rules. Remove those and move the rules into code, then the leak becomes an embarrassment rather than a compromise.
Carry it forwardSay the edition with the ID; the numbering changed.
Weak answerCiting LLM07 or LLM06 without the year.
Constraint changes
What if the review finds nothing under LLM04 Supply Chain?
Did anyone list every model, package and plugin the assistant uses?
Look again at what was in scope. Supply chain covers the model provider and its terms, any open weights or adapters, plugins and MCP servers, embedding models, Python packages in the pipeline and datasets. An empty finding usually means the inventory is incomplete. Build the inventory first, then assess each item.
Carry it forwardNo findings often means no inventory.
Weak answerClosing an entry because nobody raised an issue.
Constraint changes
What if a stakeholder asks whether passing the Top 10 review means the assistant is secure?
Was the list written as a certification standard?
No. The list is an awareness document of common risks, not a standard or a test suite. It does not cover your business logic, your identity model or classic web flaws, and it gives no pass criteria. Use it as a checklist alongside a system-specific threat model, testing, and the Agentic Top 10 if the assistant plans and acts.
Carry it forwardThe Top 10 is a prompt for thinking, not a pass mark.
Weak answerReporting compliance with the OWASP Top 10.
Now defend it
How would you use the list well?
Name the edition with each ID; group entries by the path they form (injection to agency to output handling); prioritise the entries that chain into real impact for this system; require an inventory before assessing supply chain; map each finding to an owner and control; and use the list next to a threat model and testing, never as a certification.
How it's scored
Weak: Recites some names, mixes editions without saying so, gives no examples or controls.
Hire: Names all ten correctly for a stated edition, with examples and controls.
Strong Hire: Flags the two editions and maps between them, explains what the 2026 ranking method and reshuffle signal, groups entries and impacts, applies the list to a specific system to pick priorities, and names what the list does not cover.
Common mistakes
- Quoting an ID without the year, so "LLM03" means two different things.
- Treating the list as a complete threat model.
- Ticking items off without recording a design decision.
- Giving every item equal weight regardless of the system.