EXPLAINER

OWASP Top 10 for LLM Applications

standardfreshness: volatilekey claims checked 2026-10-09

The OWASP Top 10 for LLM Applications is a community-maintained list of the most critical security risks in LLM-based applications, such as prompt injection, sensitive information disclosure and excessive agency.

Short answer: A checklist of top LLM-app risks (including prompt injection, improper output handling, sensitive information disclosure, supply-chain issues, excessive agency). Use it to structure threat modelling and testing; categories and numbering differ between editions, so cite the version.

What is it?

OWASP is the group famous for the "Top 10" web-security risks. They publish a similar list for AI applications, so teams have a shared checklist of what tends to go wrong and how to defend against it.

Also known as: OWASP LLM Top 10, OWASP GenAI, LLM01 prompt injection, excessive agency, insecure output handling, LLM security risks, LLM application security checklist, OWASP AI security.

Technical definition

Maintained under the OWASP GenAI Security Project. Version 1.0 was published in August 2023, a 2025 edition followed, and the OWASP GenAI LLM Top 10 2026 was published in early August 2026 (OWASP's resource page is dated 3 August, its repository README says 4 August; current edition as of 2026-10-09). The 2026 list is: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Excessive Agency, LLM04 Supply Chain, LLM05 Data and Model Poisoning, LLM06 Unbounded Consumption, LLM07 Misinformation, LLM08 Hidden Context Exposure, LLM09 Vector and Embedding Weaknesses, LLM10 Improper Output Handling. Prompt injection was also first in the 2023 list. Category names and order change between editions (for example, the 2025 edition's system-prompt leakage category does not appear under that name in 2026), so always cite the edition. Use as a taxonomy, not a complete security programme.

Entity type: standard · Freshness class: volatile.

When should I use it?

Standard starting point for LLM-app security review.

Implementation patterns

  • Walk each category against your architecture.
  • Convert each into tests.
  • Track mitigations per risk.
  • Re-review when the list updates.

Technologies and frameworks

Commonly associated: OWASP GenAI Security Project resources, threat-modelling tools. Names are examples of what exists, not recommendations, and projects change quickly.

Practical guide

  1. Get the current edition.
  2. Map risks to your system.
  3. Prioritise by impact.
  4. Implement and test mitigations.

Common failure modes

  • Treating it as exhaustive.
  • Citing outdated numbering.
  • Ignoring non-LLM components.

Troubleshooting

  • Unsure which risks apply — Draw a data-flow diagram and mark trust boundaries; map each risk to a component.

Contrasted with

Questions this page answers

  • What is the OWASP Top 10 for LLMs?
  • What is excessive agency?
  • What are the biggest security risks of LLM apps?
  • What is LLM01?

Typical goals: threat-model an LLM application; cite a recognised risk taxonomy.

Sources and verification

Status: key claims checked on 2026-10-09 against the primary sources listed below; everything else is not independently verified. The claims under "Checked against primary sources" were compared with the linked pages on that date. Pages change, so re-check anything time-sensitive before relying on it.

Checked against primary sources (2026-10-09):

  • The OWASP GenAI Security Project publishes an "OWASP GenAI LLM Top 10 2026"; its resource page is dated 3 August 2026 and the repository README (read in the earlier audit) gives 4 August 2026.
  • The 2026 list as read from the repository README, and the 2023 v1.0 publication date of August 2023, as recorded in the earlier audit.

Primary sources consulted:

Not independently verified:

  • The exact publication day (3 versus 4 August 2026): the two OWASP sources differ by one day, so this page says "early August 2026".
  • Each category description beyond its name.

Freshness class: volatile — Products, versions, protocols, benchmarks, leaderboards, regulations and dates. Verify against the primary source before relying on specifics; re-review every 3 months.

Time-sensitive claims to verify before relying on them:

  • Edition, category names and ranking.

Further reading and canonical sources (not all checked):

  • OWASP GenAI LLM Top 10 2026 (current edition at review) — genai.owasp.org/resource/owasp-genai-llm-top-10-2026/
  • OWASP Top 10 for LLM Applications 2025 (archived edition) — genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/
  • Active source repository — github.com/GenAI-Security-Project/GenAI-LLM-Top10
Learning path: Governing AI (step 7 of 7)
← AI Bias and Fairness