OWASP Top 10 for LLM Applications
In plain wordsA widely used checklist, written by volunteer security experts, of the ten most serious security risks in software built on AI language models, with advice on preventing each one.
A ranked list of the most critical security risks in applications built on large language modelslarge language model, n.: A computer program trained on enormous amounts of text to predict the words that come next. At vast scale, that simple skill lets it chat, answer questions, translate, summarize and write code., with descriptions, example attack scenarios and mitigations, published by OWASP (the Open Worldwide Application Security Project), a nonprofit known for its web-application Top 10. As of October 2026 the current edition (August 2026, titled OWASP GenAI LLM Top 10 2026) lists, in order: Prompt Injection; Sensitive Information Disclosure; Excessive Agency; Supply Chain; Data and Model Poisoning; Unbounded Consumption; Misinformation; Hidden Context Exposure, which replaced System Prompt Leakage; Vector and Embedding Weaknesses; and Improper Output Handling. Entries are cited as LLM01 to LLM10 with the edition year. The list is not a formal standard, but it is widely used in security reviews, procurement checklists and tooling. Its parent project, now the OWASP GenAI Security Project, also publishes a companion Top 10 for Agentic Applications (December 2025).
The penetration-test report maps every finding to the OWASP Top 10 for LLM Applications, mostly LLM01 and LLM03.
Origin
Begun in May 2023 by a volunteer group led by Steve Wilson; version 1.0 appeared in August 2023. The 2025 edition (November 2024) added System Prompt Leakage and Vector and Embedding Weaknesses, and broadened Overreliance into Misinformation and Model Denial of Service into Unbounded Consumption. The 2026 edition reordered the list, moving excessive agencyexcessive agency, n.: Giving an AI system more power than its job needs — too many tools, too-broad permissions or too little human sign-off — so that a mistake or a trick can do real damage. from sixth to third.
Related
- prompt injectionprompt injection, n.: Tricking an AI system by slipping in text that it mistakes for instructions — for example, a hidden line in an email telling an AI assistant to forward the user's messages to a stranger.
- excessive agencyexcessive agency, n.: Giving an AI system more power than its job needs — too many tools, too-broad permissions or too little human sign-off — so that a mistake or a trick can do real damage.
- data poisoningdata poisoning, n.: Sneaking bad examples into the data an AI learns from, so the finished model behaves as the attacker wants — badly overall, or wrongly only in special situations.
- AI supply chain securityAI supply chain security, n.: Protecting everything an AI system is built from — downloaded models, datasets, code libraries and tools — against tampering, so a poisoned or fake part cannot sneak into the finished product.
- MITRE ATLASMITRE ATLAS, prop. n.: A free online reference from the US nonprofit MITRE that maps, step by step, how attackers go after AI systems, with examples drawn from real attacks and security tests.
- AI securityAI security, n.: Protecting AI systems — their data, models and surrounding software — from being attacked, stolen or tricked, and dealing with the ways AI itself can be used to attack others.
- sponge examplesponge example, n.: An input crafted to make an AI system work as hard as possible — burning extra energy and time — to slow it down or run up costs, rather than to make it answer wrongly.
Sources
- OWASP GenAI Security Project (2026). OWASP GenAI LLM Top 10 2026. genai.owasp.org/resource/owasp-genai-llm-top-10-2026
- OWASP GenAI Security Project (2025). OWASP Top 10 for Agentic Applications for 2026. genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026
Mentioned in
AI securityAI security, n.: Protecting AI systems — their data, models and surrounding software — from being attacked, stolen or tricked, and dealing with the ways AI itself can be used to attack others., prompt injectionprompt injection, n.: Tricking an AI system by slipping in text that it mistakes for instructions — for example, a hidden line in an email telling an AI assistant to forward the user's messages to a stranger., AI supply chain securityAI supply chain security, n.: Protecting everything an AI system is built from — downloaded models, datasets, code libraries and tools — against tampering, so a poisoned or fake part cannot sneak into the finished product., excessive agencyexcessive agency, n.: Giving an AI system more power than its job needs — too many tools, too-broad permissions or too little human sign-off — so that a mistake or a trick can do real damage., MITRE ATLASMITRE ATLAS, prop. n.: A free online reference from the US nonprofit MITRE that maps, step by step, how attackers go after AI systems, with examples drawn from real attacks and security tests., prompt leakingprompt leaking, n.: Getting an AI application to reveal the hidden instructions its makers gave it, such as its secret setup text or rules., sponge examplesponge example, n.: An input crafted to make an AI system work as hard as possible — burning extra energy and time — to slow it down or run up costs, rather than to make it answer wrongly.