OWASP 2026 LLM Top 10: “The model will be fooled”
The OWASP GenAI Security Project has released the 2026 edition of its Top 10 for LLM Applications and, for the first time, the list was influenced by real-world incidents.
The two top entries – Prompt Injection and Sensitive Information Disclosure – remained constant, but the order shifted more than in past years below them:
The 2025 and 2026 versions of OWASP 2026 LLM Top 10, compared (Source: OWASP)
Data enters the list-building process
Every prior version of this Top 10 list rested on consensus: hundreds of practitioners voting on which risks matter most.
This time around, the vote still carried 75% of the weight, but the remaining 25% was influenced by the data from 6,639 real incidents pulled from public vulnerability databases and an AI-harm database.
The split was deliberate. As the project leads put it, this list “is a consensus product, and one noisy year of data does not get to overturn the judgment of the people doing the work.” Still, a quarter-weight was enough to move an entry a tier when belief and evidence diverged sharply.
The biggest shifts
Prompt Injection is still number one, though there haven’t been many recorded incidents involving it.
OWASP calls this a “defense effect.” Teams work so hard to block prompt injection that fewer successful attacks ever show up in public databases, which makes the risk look smaller than it is, even though organizations are spending real money to keep it at bay.
The opposite happened to Misinformation, which climbed two places even though voters placed it near the bottom: the incident record ranked it near the top, and that pushed it up.
Incorrect, incomplete, unsupported, or misleading output may sound believable to humans and agents, the project leads explained.
“In modern systems, model outputs drive tool calls, generate code, infer system state, authorize actions, and coordinate across agents. This makes misinformation a system-level failure that can lead to financial loss, security incidents, safety risks, or operational disruption,” they added.
Excessive Agency – i.e., when an AI system is given too much power to act on its own – climbed to third place, due to both the experts’ vote and the data agreeing that agentic deployments are where damage is landing.
Unbounded Consumption rose four places, driven by practitioners who now weigh resource and cost exhaustion more heavily, and Output Handling fell from fifth to tenth (and absorbed more scope).
System Prompt Leakage was renamed and broadened to Hidden Context Exposure.
Several entries also absorbed sharper risks rather than spawning new categories: Prompt Injection now covers cross-modal attacks hidden in images or audio, and Data and Model Poisoning absorbs fine-tuning subversion.
Know the limits
One idea runs through all ten entries, and the leads open with it: “Stop trying to build a model that cannot be fooled. Build the system around it, so that when the model is fooled, and it will be, nothing important breaks.” This reframes the list as blast-radius control rather than perfect prevention.
The OWASP Top 10 for LLM Applications 2026 edition is also unusually clear about its own boundary: it outlines and orders risks related to models as a component inside an application.
“The moment that model becomes an actor, with tools it can call, memory it carries between sessions, and consequences it sets in motion downstream, the risk moves to the OWASP Agentic Top 10,” the project leads noted.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!