If you are evaluating your LLM deployment posture or advising a team on where to put security controls, the OWASP GenAI LLM Top 10 2026, published on 2026-08-03, is the most practical framework available for scoping that work. This article walks through each of the ten current risk categories, the controls OWASP recommends, and where defenses fall short so you can layer appropriately. Several risk IDs moved in this edition, so check the number as well as the name before reusing an older mapping.
What changed in the 2026 edition
The 2025 edition established the current shape of the list. The 2026 revision keeps the same ten-slot structure but reranks most of it, so a control matrix built against the 2025 numbering will now point at the wrong categories:
- Excessive Agency moved from LLM06 to LLM03, the largest jump in the list, reflecting how much of the deployed surface is now agents with tool access rather than chat endpoints.
- Hidden Context Exposure (LLM08) replaces System Prompt Leakage. The scope widened from the system prompt string to everything else the model holds that carries confidentiality risk: retrieved documents, agent memory, tool responses, and application state.
- Misinformation moved from LLM09 to LLM07, and Unbounded Consumption from LLM10 to LLM06.
- Supply Chain moved from LLM03 to LLM04, Data and Model Poisoning from LLM04 to LLM05, Vector and Embedding Weaknesses from LLM08 to LLM09, and Improper Output Handling from LLM05 all the way down to LLM10.
Prompt Injection (LLM01) and Sensitive Information Disclosure (LLM02) held the top two slots. A demotion here is a ranking change, not a statement that the risk went away: Improper Output Handling at LLM10 is still the reason model output reaching a shell or a browser is a live vulnerability.
Tier-by-Tier Control Mapping
LLM01: Prompt Injection. The highest-priority risk and the one with the widest residual attack surface after controls are applied. Mitigations include strict role instructions in system prompts, input sanitization, output format enforcement via JSON Schema or structured-output mode, and privilege segregation that prevents injected instructions from reaching privileged tool calls. Direct injection (via user turn) and indirect injection (via retrieved document content) require separate detection logic. Red-teaming this category continuously matters more than any single static control; the Promptfoo framework’s adversarial plugin suite covers both injection vectors against deployed endpoints. For a deeper look at offensive techniques motivating these defenses, aisec.blog covers prompt injection and jailbreak tradecraft in technical detail.
LLM02: Sensitive Information Disclosure. Training-time and inference-time leakage require different controls. At inference time: output filtering for PII patterns, secrets scanning on completions, and access-scoped context windows so users cannot extract data outside their authorization boundary. At training time: data minimization, differential privacy where budget allows, and membership-inference testing before production deployment.
LLM03: Excessive Agency. Agentic systems that can browse, write files, send email, or call APIs are high-value targets precisely because compromising the model compromises every tool the model can reach. The principle of least privilege applies directly: grant the minimal tool set the task actually requires, require explicit user approval for irreversible or high-impact actions, and enforce separation between the planning context and the execution context. GuardML covers runtime guardrail tooling that enforces tool-call policies at the agent boundary, which is the right layer for this control.
LLM04: Supply Chain. Every fine-tuned model, every third-party embedding API, every external dataset is an attack surface. Controls: integrity verification (cryptographic signing, hash checks) for model weights and adapter layers; a signed Software Bill of Materials (SBOM) per OWASP CycloneDX ML extensions; behavioral acceptance testing against a standardized red-team suite before any model upgrade lands in production. Static scanning tools can detect embedded executables and backdoor triggers in serialized weights, which is the control class covered in the ModelScan and NB Defense review.
LLM05: Data and Model Poisoning. Malicious training data can install behavioral backdoors that trigger on specific token sequences. Practical defenses: vet data vendors against provenance documentation, run anomaly detection over label distributions, and hold out a clean evaluation set for post-training behavioral regression testing. For agentic systems with continuous learning, treat every new data ingestion as a supply-chain event with the same controls as LLM04.
LLM06: Unbounded Consumption. Token-exhaustion attacks inflate cost and degrade availability. Controls: per-user and per-session rate limits, maximum token budgets per request enforced at the API gateway layer, queue depth monitoring with autoscaling guards, and cost anomaly alerting. Recursive prompt patterns that expand token usage through chained tool calls require specific detection logic beyond simple per-request limits.
LLM07: Misinformation. Hallucination becomes an attack when an adversary can predict or trigger false outputs to influence downstream decisions. Mitigations: Retrieval-Augmented Generation grounded to vetted source corpora, citation requirements enforced in system prompts, human-in-the-loop review for high-stakes outputs, and output confidence scoring where the model supports it. RAG reduces but does not eliminate hallucination: grounding helps with factual recall but not with adversarially crafted retrieval contexts.
LLM08: Hidden Context Exposure. This category now covers every piece of context the model can reveal, not just the system prompt: retrieved documents, agent memory, tool responses, and application state. System prompts still encode business logic, customer data, and API keys, none of which belong there. Controls: keep credentials and sensitive context in environment variables or secrets managers accessed via secure lookups, not embedded in the prompt string; scope memory and tool output to the requesting user; monitor output for verbatim fragments of any of these; rotate prompt and context content periodically to reduce the value of a leaked snapshot.
LLM09: Vector and Embedding Weaknesses. RAG pipelines introduce a new attack path: poisoning the vector store to control what context gets retrieved, or exploiting access-control gaps to retrieve documents outside the querying user’s authorization scope. Controls: strict logical partitioning in the vector database with per-user or per-role namespace isolation; input sanitization on content before it is chunked and embedded; regular audits of retrieval results against expected authorization boundaries. Embedding inversion (recovering training data from embedding vectors) is an emerging threat that differential-privacy techniques partially address.
LLM10: Improper Output Handling. LLM outputs fed directly to browsers, SQL engines, or shell interpreters without sanitization reproduce the classic injection triage: XSS, SQLi, command injection, now triggered by model output. Apply context-aware encoding: HTML-encode before rendering, parameterize before querying, sandbox before executing. Treat model output as untrusted user input at every downstream boundary. Its drop to the bottom of the ranking reflects how often it is caught by existing application controls, not that the failure mode is rare.
Building the Control Stack
OWASP structures each entry with Prevention and Mitigation Strategies, Example Attack Scenarios, and Reference Links; the 2026 resource page is where the authoritative document is published and is the source for implementation detail. In practice, the controls cluster into three layers:
- Input layer — sanitization, injection detection, rate limiting, prompt structure enforcement.
- Output layer — format validation, PII filtering, downstream encoding, secrets scanning.
- Runtime/governance layer — tool-call allowlists, human approval gates, audit logging, supply-chain provenance, cost monitoring.
No single control addresses the full list. LLM01 (prompt injection) and LLM03 (excessive agency) are the highest-leverage targets for most teams deploying non-trivial agentic systems, which is exactly why agency moved up three places this edition; LLM04 and LLM09 become critical once fine-tuning and RAG pipelines are in scope. A tiered rollout, hardening the input and output perimeter first and then closing the agency and supply-chain gaps, is more realistic than attempting all ten simultaneously.
Turning the list into an assessment
A control catalog is not an assessment. To walk a specific system against these ten categories in order — inventory, trust boundaries, control mapping, evidence, governance, retest cadence — use the AI security review checklist, which uses this taxonomy as its stage-three vocabulary.
Two categories carry enough depth to need their own treatment. LLM09 (Vector and Embedding Weaknesses) is worked through end to end in RAG pipeline security best practices, covering ingestion, retrieval and generation controls separately. LLM01 detection options, and their measured trade-offs, are in how prompt injection detection works.
