On August 4, 2026, the OWASP GenAI Security Project released the most extensive overhaul theOWASP Top 10 for LLM applications since its creation in 2023: eight of the ten categories changed positions, one was renamed, and its scope was substantially expanded. A groundbreaking methodological innovation for this edition: the ranking is no longer based solely on a community vote, but combines this vote with an analysis of 7,714 real-world LLM security incidents, of which 6,639 were sufficiently documented to be classified, weighted at 75% for the vote and 25% for the incident data. This cross-analysis revealed significant discrepancies between what practitioners fear and what actually happens in production, with concrete implications for the final ranking.
LLM01 through LLM04: Prompt Injection, Data Leaks, and the Supply Chain
LLM01:2026 Prompt Injection retains the top spot—as previously detailed in our dedicated article—with its scope expanded to include cross-modal attacks (instructions hidden in an image, audio file, or video) and persistence in memory or within a RAG corpus, where a single successful injection continues to compromise every subsequent interaction.
A paradox documented by the authors is worth noting: the number of incidents recorded for this risk is actually lower than for other categories—a sign not of a declining risk but of a defensive effect, as mature teams are actively combating this vector, thereby limiting the number of compromises affecting public databases.
LLM02:2026 Sensitive Information Disclosure covers the disclosure, through a model’s responses, of data that it should never have revealed—such as personal information memorized during training, trade secrets present in its context, or technical details about its own operation. This category covers the unintentional retention of training data and the disclosure of confidential content embedded in the context of a conversation. This category also retains its second-place ranking, as the only category where community voting and incident data are in perfect agreement.
LLM04:2026 Supply Chain drops from third to fourth place. This category covers all third-party components used in the construction of an LLM system: pre-trained models downloaded from community platforms, training datasets of unverified origin, and plugins and extensions installed without security review. This edition places particular emphasis on the failure of the chain of trust, an indirect injection risk that we documented in our article on slopsquatting, where attackers trap entire ecosystems by registering fictitious software packages recommended by AI systems.
LLM05:2026 Data and Model Poisoning drops from fourth to fifth place and now explicitly incorporates subversion via fine-tuning, a topic central to our article on Model Poisoning.
LLM03 through LLM10: Output Processing and Excess Autonomy
LLM03:2026 Excessive Agency made the most dramatic rise in the rankings, moving from sixth to third place—the biggest climb—and the one where the voting results and incident data align most clearly. This category focuses not only on the capabilities an agent should not possess, but also on the fact that an agent capable of undertaking more actions than its mission requires becomes, by design, a larger attack surface. This category, which we’ve already covered in our articles on AI agents and the MCP, now explicitly refers to the new OWASP Top 10 for Agentic Applications for cases where the model is no longer a simple component but an autonomous actor.
LLM08:2026 Hidden Context Exposure (formerly “system prompt leakage”) broadens its scope: it no longer targets only the system prompt, but rather the extraction of all hidden operational context (RAG data, MCP tool schemas, formatting rules). OWASP establishes a key principle: the context window is not a secret space. This risk becomes critical when API keys are injected into it or when security relies on this hidden context. Revealing moderation guidelines or tool schemas provides attackers with a precise roadmap to bypass filters (Prompt Injection) or exploit downstream functions. Authorization and moderation must therefore be managed by external deterministic controls, without ever relying on the model’s textual guidelines.
LLM09:2026 “Vector and Embedding Weaknesses” drops from eighth to ninth place, with the scope remaining unchanged; the exploitation mechanisms for this vulnerability are illustrated in our article on RAG Poisoning.
LLM10:2026 Improper Output Handling has seen the sharpest drop in the rankings, falling from fifth to tenth place—not because the risk has decreased, but because the agent-related vulnerabilities ranked above it have become more urgent. This category covers the following principle: model output should never be considered trustworthy by default. A generated response, sent without validation to a browser, database, or command interpreter, opens the door to XSS attacks, SQL injections, or remote code execution (RCE). Its scope now includes new rendering channels: ANSI escape sequences interpreted by a terminal or an IDE, as well as the automatic rendering of Markdown images or link previews that allow for the stealthy exfiltration of data to a remote server.
LLM06 and LLM07: Overconfidence and Uncontrolled Consumption
LLM06:2026 “Unbounded Consumption ” has seen the second-largest rise in the rankings, moving from tenth to sixth place, with a complete reframing: it is no longer just about classic denial-of-service attacks, but rather cost asymmetry—an attacker can trigger a disproportionately costly computation with virtually no effort on their part, a risk amplified by extended reasoning models and toolchains connected via MCP.
LLM07:2026 Misinformation moves up from ninth to seventh place, with the widest gap observed between the community vote and actual incident data in the entire ranking: practitioners significantly underestimate this risk compared to its actual frequency. The reason lies in changing practices: a hallucinated response that triggers an automated action in an agent-based pipeline is no longer simply an error displayed on the screen; it becomes an erroneous action executed downstream. This category addresses the production of false or misleading content by a model, but above all its acceptance without verification by the systems or people who use this output; the hallucination becomes a security risk in its own right as soon as an operational, financial, or legal decision is based on it without verification.
OWASP LLM Top 10 vs. Agentic (ASI): Which Framework Should You Use for Your AI Project?
The most significant structural change in 2026 is the distinction drawn for the first time between two complementary documents. The LLM Top 10 addresses the risk when the model is a component within an application. The OWASP Top 10 for Agentic Applications (AS), published on December 9, 2025, and identified by the prefix ASI, covers the risk when the model becomes a full-fledged agent, capable of invoking tools, maintaining persistent memory across sessions, and trigger downstream consequences. Its ten entries range from an agent’s purpose being hijacked (ASI01) to agents becoming uncontrollable (ASI10). The authors explicitly state that neither document covers the entire subject on its own: for any architecture closely related to agent-based systems—which now applies to the vast majority of deployments—both lists must be consulted together, particularly for the “Excessive Agency” and “Unbounded Consumption” categories, which now explicitly refer to one another.
→ See our guide on AI architectures and risk vectors for an overview organized by technical component.
FAQ: Security and Auditing of LLM Systems According to the 2026 Framework
Which OWASP guidelines should be applied?
The two are complementary. The LLM Top 10 covers risks related to the model and the application. The Agentic Top 10 applies when AI can use tools, retain memory, or perform actions.
How can you prevent a leak of sensitive data?
It is necessary to limit the data provided to the model, apply access rights before performing a RAG search, and filter the responses. Sensitive data must be compartmentalized, protected, and subject to retention policies.
How can you monitor the actions of an AI agent?
The agent must apply the principle of least privilege, use a dedicated identity, and be subject to controls external to the model. Sensitive actions must require human validation and be capable of being stopped.
Can we trust a generated response?
No. An output must be validated before it is sent to a database, an API, a browser, or a device. This validation helps prevent errors, data injection, and incorrect actions.
Audit Your AI System According to the 2026 Standard
Our experts structure their AI audits and penetration tests around the latest edition of this framework.
Would you like to discuss your project or assess your needs? Contact our experts.