Evaluating language models
OWASP top 10 for LLM applications
The OWASP Top 10 for LLM Applications lists major application security risks. The current 2026 edition starts with prompt injection.
Nov 10, 20265 min read15 sources
Why it matters
A security review must cover retrieval, tools, data, outputs, and resource limits as well as the model's responses.
The short version
- 1The current published OWASP Top 10 for LLM Applications is the 2026 edition, released August 4, 2026.
- 2LLM01 remains Prompt Injection; Excessive Agency is LLM03 in the 2026 list.
- 3Enforce authorization, output validation, and resource limits in the application rather than relying on prompts alone.
The Open Worldwide Application Security Project (OWASP) Top 10 lists 10 security risks for large language model (LLM) applications. The guide provides explanations, attack examples, and defenses for each risk (OWASP About; official 2026 guide).
Use the list to review the complete application: inputs, retrieved documents, tools, data stores, outputs, and resource limits.
Which OWASP LLM top 10 version is current?
The current published edition is 2026, released August 4, 2026. OWASP's official repository identifies the published list and its final source files (2026 release record).
The general project landing page still displays the 2025 list. The 2025 list uses a different order from the 2026 release (2025 list).
Always attach the year to an identifier in a review or test plan. LLM03:2025 and LLM03:2026 refer to different entries.
OWASP top 10 for LLM applications
The table follows the official 2026 order. Each linked entry supplies the definition and the suggested defense.
| Entry | Plain meaning | 1 defense |
|---|---|---|
| LLM01:2026 Prompt Injection | Untrusted instructions redirect behavior away from the application's intended task. | Enforce tool permissions in application code. |
| LLM02:2026 Sensitive Information Disclosure | Protected information escapes through answers, tool arguments, logs, or other channels. | Check access before retrieving each document or chunk. |
| LLM03:2026 Excessive Agency | Excess tools, permissions, or autonomy expose the application to damaging actions. | Give each workflow narrowly scoped tools and permissions. |
| LLM04:2026 Supply Chain | Compromised models, dependencies, datasets, or build processes undermine application integrity. | Verify the provenance and integrity of imported artifacts. |
| LLM05:2026 Data and Model Poisoning | Manipulated data or model artifacts introduce unwanted behavior or exploitable weaknesses. | Restrict writes and track dataset and model lineage. |
| LLM06:2026 Unbounded Consumption | Uncontrolled inference or downstream work exhausts service capacity or budgets. | Enforce hard spending and execution limits. |
| LLM07:2026 Misinformation | Incorrect or unsupported output drives mistaken decisions or actions. | Verify claims against authoritative evidence before acting. |
| LLM08:2026 Hidden Context Exposure | Exposed internal instructions or operational context give attackers useful capabilities. | Keep secrets out of model-visible context and enforce authorization outside the model. |
| LLM09:2026 Vector and Embedding Weaknesses | Embedding and similarity-search weaknesses corrupt retrieval or cross access boundaries. | Enforce tenant and document/chunk permissions within server-side index queries. |
| LLM10:2026 Improper Output Handling | Unchecked generated content reaches systems that interpret it as executable or actionable input. | Validate and encode output for its destination. |
These are starting controls. Record where each control runs and how a test demonstrates that it holds.
OWASP LLM top 10 2025 vs 2026
Several entries changed position, and Hidden Context Exposure replaced the narrower System Prompt Leakage label. The following comparison uses OWASP's published lists (2025 list; 2026 release record).
| Topic | 2025 | 2026 |
|---|---|---|
| Prompt Injection | LLM01 | LLM01 |
| Excessive Agency | LLM06 | LLM03 |
| Unbounded Consumption | LLM10 | LLM06 |
| Internal context exposure | LLM07, System Prompt Leakage | LLM08, Hidden Context Exposure |
| Improper Output Handling | LLM05 | LLM10 |
The 2026 hidden-context entry addresses non-user-facing instructions and operational context, including exposure that helps an attacker. Review more than the system prompt alone (LLM08:2026).
For older material, OWASP maintains a 2023-24 archive. That list includes standalone entries called Insecure Plugin Design, Overreliance, and Model Theft. Keep those historical labels attached to that edition (official 2023-24 archive).
What is LLM01 and OWASP prompt injection?
LLM01 is Prompt Injection. Direct injection arrives through user input. Indirect injection arrives through material the application reads, such as documents, web pages, or tool responses (LLM01:2026).
The key question is what authority that content receives. Treat retrieved material as data, and check privileged operations in ordinary application code. A prompt instruction to ignore hostile text does not replace those controls.
OWASP describes layered defenses and warns that reliable prevention remains unresolved. Limit the consequences of an instruction that gets through, including tool access and sensitive-data exposure (LLM01:2026).
For examples of the 2 entry routes, see direct vs indirect prompt injection.
Which controls belong outside the model?
Authorization, secret storage, and consequential action checks belong in application components that enforce rules independently of generated text. OWASP makes that distinction in Excessive Agency and Hidden Context Exposure (LLM03:2026; LLM08:2026).
For a tool-using application, start with 3 decisions:
- Define which actions each user may request.
- Give the workflow only the tools and permissions required.
- Require appropriate review before consequential actions execute.
Treat output handling as a separate boundary. Content headed for a browser, database, or command processor needs validation suited to that destination. Text that looks acceptable in a chat window is not automatically acceptable as executable input (LLM10:2026).
For retrieval, enforce access restrictions within the server-side search query. Filtering a completed answer is too late if unauthorized content has already entered the model's context (LLM09:2026).
How should you test these risks?
Test a concrete failure path and define the required safe result before running it. The following checks apply the controls in the linked entries.
| Area | Test to design | Required result |
|---|---|---|
| Retrieval isolation | Search for a document assigned to another tenant | The unauthorized document never enters retrieved context |
| Logging | Run a workflow with synthetic sensitive values | Logs and traces follow the configured disclosure controls |
| Resource use | Trigger repeated work within a bounded test | The configured budget or execution limit stops further work |
| Output handling | Send generated content to its intended renderer | Destination-specific validation prevents unintended interpretation |
The first 2 checks follow OWASP's retrieval authorization and logging guidance (LLM09:2026; LLM02:2026). The others follow its resource-limit and output-handling guidance (LLM06:2026; LLM10:2026).
For resource tests, include tokens, time, repeated tool calls, and cost. OWASP distinguishes request-rate limits from hard caps that actually stop spending (LLM06:2026).
For model and data updates, keep versions and lineage so you know what changed. Validate incoming material and test for unwanted behavior after changes (LLM05:2026).
Supply-chain verification also needs both integrity checks and behavior testing. A verified signature establishes origin and integrity; it does not establish that an artifact is safe (LLM04:2026).
Finally, verify evidence behind consequential answers. OWASP's misinformation entry calls for authoritative grounding and checks before generated content drives action (LLM07:2026).
Record the version, input, expected result, observed result, and responsible owner for each test. For a broader testing workflow, see red-teaming language models.
What to do next
- Update your review checklist to the 2026 names and identifiers.
- Map each entry to an application component and owner.
- Review tool permissions, retrieval access, and secret handling.
- Add destination-specific output validation and hard resource limits.
- Run a concrete test for each exposed risk and retain the results.
Azcuna's ELLMENT, the E-2D Large Language Model Entity, was proposed to NAVAIR PMA-231 under Navy SBIR Phase I topic DON26BZ01-NV010. The prototype, built at private expense on publicly available doctrine, answers with a page-level citation and refuses when the documents do not support an answer. The proposal has been submitted.
Questions people ask
What is the OWASP top 10 for LLM applications?
The OWASP Top 10 for LLM Applications is a guide to major security risks across applications that use large language models. The official 2026 guide provides explanations, attack examples, and mitigations. It covers inputs, information disclosure, tools, supply chains, data, retrieval, outputs, and resource use.
Is OWASP LLM top 10 2025 the latest version?
No. The official project repository identifies the 2026 edition as published on August 4, 2026. The general website landing page still displays the 2025 list. Use the published 2026 release and include the edition year when recording identifiers, since several risks changed position.
What is OWASP LLM01?
LLM01:2026 is Prompt Injection. The official entry distinguishes direct user-input attacks from indirect attacks through material such as retrieved documents or tool responses. Defenses include separating untrusted content, restricting tool privileges, and checking sensitive actions outside the model. OWASP does not describe a reliable universal prevention mechanism.
What changed from the 2025 OWASP LLM top 10?
The official 2026 list places Excessive Agency third and Unbounded Consumption sixth. Improper Output Handling moves to tenth. Hidden Context Exposure takes a broader scope than the earlier System Prompt Leakage entry. Prompt Injection and Sensitive Information Disclosure remain first and second, respectively.
Does preventing prompt injection address every OWASP LLM risk?
No. OWASP lists separate risks involving supply chains, poisoned data, sensitive disclosure, excessive permissions, retrieval, resource consumption, misinformation, and output handling. Review the controls around each application component. A prompt-injection defense does not by itself verify model artifacts, enforce document permissions, or bound spending.
Sources
- 1About the OWASP Foundation · OWASP Foundation
- 2OWASP GenAI LLM Top 10 2026 · OWASP GenAI Security Project
- 3OWASP Top 10 for LLM Applications 2026 - Release record · OWASP GenAI Security Project
- 42025 Top 10 Risk & Mitigations for LLMs and Gen AI Apps · OWASP GenAI Security Project
- 5LLM01:2026 Prompt Injection · OWASP GenAI Security Project
- 6LLM02:2026 Sensitive Information Disclosure · OWASP GenAI Security Project
- 7LLM03:2026 Excessive Agency · OWASP GenAI Security Project
- 8LLM04:2026 Supply Chain · OWASP GenAI Security Project
- 9LLM05:2026 Data and Model Poisoning · OWASP GenAI Security Project
- 10LLM06:2026 Unbounded Consumption · OWASP GenAI Security Project
- 11LLM07:2026 Misinformation · OWASP GenAI Security Project
- 12LLM08:2026 Hidden Context Exposure · OWASP GenAI Security Project
- 13LLM09:2026 Vector and Embedding Weaknesses · OWASP GenAI Security Project
- 14LLM10:2026 Improper Output Handling · OWASP GenAI Security Project
- 15Top 10 for LLMs and Gen AI Apps 2023-24 · OWASP GenAI Security Project
Where this shows up in our work
- CALIBER, the market testbed for AI agents measures from an AI agent's trades whether it is gullible, herds, overpays, or can be steered.
- ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.