# crosswalk·OWASP LLM 2026·ASI 2026·ATLAS 2026.10·NIST AI 600-1
Framework crosswalk
The 2026 OWASP LLM list mapped to the OWASP Agentic list, MITRE ATLAS tactics and NIST AI 600-1 risks. The mappings are OWASP's own, from Appendix A of the 2026 PDF. We moved them into a table you can read in a browser.
OWASP LLM Top 10 (2026)
Bold entries are OWASP's primary mappings; the rest are supporting. ATLAS tactic names come from release 2026.10. OWASP mapped against ATLAS 2026.06, in which AML.TA0001 was called "AI Attack Staging".
| 2026 entry | Was (2025) | OWASP Agentic 2026 | MITRE ATLAS tactics | NIST AI 600-1 |
|---|---|---|---|---|
| LLM01:2026 Prompt Injection | LLM01:2025 Prompt Injection | ASI01 Agent Goal Hijack ASI02 Tool Misuse and Exploitation ASI03 Identity and Privilege Abuse ASI05 Unexpected Code Execution (RCE) ASI06 Memory & Context Poisoning ASI08 Cascading Failures ASI09 Human-Agent Trust Exploitation | AML.TA0004 Initial Access AML.TA0005 Execution AML.TA0006 Persistence AML.TA0007 Defense Evasion AML.TA0010 Exfiltration AML.TA0001 AI Attack Adaptation AML.TA0011 Impact AML.TA0012 Privilege Escalation | Information Security Information Integrity Data Privacy Human-AI Configuration |
| LLM02:2026 Sensitive Information Disclosure | LLM02:2025 Sensitive Information Disclosure | ASI06 Memory & Context Poisoning | AML.TA0010 Exfiltration AML.TA0013 Credential Access AML.TA0000 AI Model Access AML.TA0007 Defense Evasion | Data Privacy Information Security Intellectual Property Value Chain and Component Integration |
| LLM03:2026 Excessive Agency | LLM06:2025 Excessive Agency | ASI01 Agent Goal Hijack ASI02 Tool Misuse and Exploitation ASI03 Identity and Privilege Abuse ASI05 Unexpected Code Execution (RCE) ASI07 Insecure Inter-Agent Communication ASI08 Cascading Failures ASI09 Human-Agent Trust Exploitation | AML.TA0005 Execution AML.TA0011 Impact AML.TA0010 Exfiltration AML.TA0012 Privilege Escalation | Information Security Human-AI Configuration Confabulation Data Privacy |
| LLM04:2026 Supply Chain | LLM03:2025 Supply Chain | ASI04 Agentic Supply Chain Vulnerabilities | AML.TA0004 Initial Access AML.TA0003 Resource Development AML.TA0005 Execution AML.TA0006 Persistence | Value Chain and Component Integration Information Security Intellectual Property Information Integrity Confabulation |
| LLM05:2026 Data and Model Poisoning | LLM04:2025 Data and Model Poisoning | ASI04 Agentic Supply Chain Vulnerabilities ASI06 Memory & Context Poisoning ASI08 Cascading Failures | AML.TA0003 Resource Development AML.TA0006 Persistence AML.TA0011 Impact AML.TA0004 Initial Access AML.TA0001 AI Attack Adaptation AML.TA0005 Execution | Information Integrity Value Chain and Component Integration Information Security Dangerous, Violent, or Hateful Content |
| LLM06:2026 Unbounded Consumption | LLM10:2025 Unbounded Consumption | ASI02 Tool Misuse and Exploitation ASI08 Cascading Failures | AML.TA0011 Impact AML.TA0010 Exfiltration AML.TA0000 AI Model Access | Information Security Intellectual Property Value Chain and Component Integration |
| LLM07:2026 Misinformation | LLM09:2025 Misinformation | ASI08 Cascading Failures ASI09 Human-Agent Trust Exploitation ASI10 Rogue Agents | AML.TA0011 Impact AML.TA0003 Resource Development AML.TA0004 Initial Access AML.TA0001 AI Attack Adaptation | Information Integrity Confabulation Human-AI Configuration Information Security Value Chain and Component Integration |
| LLM08:2026 Hidden Context Exposure | LLM07:2025 System Prompt Leakage | ASI06 Memory & Context Poisoning ASI07 Insecure Inter-Agent Communication | AML.TA0008 Discovery AML.TA0010 Exfiltration AML.TA0002 Reconnaissance AML.TA0013 Credential Access | Information Security Intellectual Property |
| LLM09:2026 Vector and Embedding Weaknesses | LLM08:2025 Vector and Embedding Weaknesses | ASI04 Agentic Supply Chain Vulnerabilities ASI06 Memory & Context Poisoning | AML.TA0006 Persistence AML.TA0010 Exfiltration AML.TA0001 AI Attack Adaptation AML.TA0011 Impact AML.TA0008 Discovery | Data Privacy Information Security Information Integrity Value Chain and Component Integration |
| LLM10:2026 Improper Output Handling | LLM05:2025 Improper Output Handling | ASI02 Tool Misuse and Exploitation ASI05 Unexpected Code Execution (RCE) ASI09 Human-Agent Trust Exploitation | AML.TA0005 Execution AML.TA0010 Exfiltration AML.TA0011 Impact AML.TA0012 Privilege Escalation | Information Security Data Privacy Confabulation Value Chain and Component Integration |
OWASP Top 10 for Agentic Applications (2026)
Published Dec. 9, 2025. OWASP says the LLM list covers a model as a component, and the Agentic list takes over once the model acts with tools, memory and delegated authority.
| ID | Name | LLM 2026 entries OWASP maps to it | Register entries |
|---|---|---|---|
| ASI01 | Agent Goal Hijack | LLM01, LLM03 | — |
| ASI02 | Tool Misuse and Exploitation | LLM01, LLM03, LLM06, LLM10 | MCP and agent tool poisoning |
| ASI03 | Identity and Privilege Abuse | LLM01, LLM03 | — |
| ASI04 | Agentic Supply Chain Vulnerabilities | LLM04, LLM05, LLM09 | MCP and agent tool poisoning |
| ASI05 | Unexpected Code Execution (RCE) | LLM01, LLM03, LLM10 | — |
| ASI06 | Memory & Context Poisoning | LLM01, LLM02, LLM05, LLM08, LLM09 | Memory and context poisoning |
| ASI07 | Insecure Inter-Agent Communication | LLM03, LLM08 | — |
| ASI08 | Cascading Failures | LLM01, LLM03, LLM05, LLM06, LLM07 | — |
| ASI09 | Human-Agent Trust Exploitation | LLM01, LLM03, LLM07, LLM10 | — |
| ASI10 | Rogue Agents | LLM07 | — |
Reusing this table
The mappings are adapted from the OWASP Top 10 for LLM Applications 2026, Appendix A, by the OWASP GenAI Security Project, licensed CC BY-SA 4.0. We kept the element IDs and the primary or supporting marker, normalized names to each framework's own list, and left out OWASP's explanations. ATLAS names are from MITRE ATLAS (Apache-2.0). You can reuse this table under CC BY-SA 4.0 with the same attribution. The dataset page has JSON and CSV.
Sources
- OWASP Top 10 for LLM Applications 2026. OWASP GenAI Security Project, Aug. 3, 2026.
- OWASP Top 10 for LLMs and Gen AI Apps (2025 list). OWASP GenAI Security Project, Nov. 18, 2024.
- OWASP Top 10 for Agentic Applications 2026. OWASP GenAI Security Project, Dec. 9, 2025.
- MITRE ATLAS data, release 2026.10. MITRE, Oct. 28, 2026.
- NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. National Institute of Standards and Technology, July 2024.