OWASP Top 10 for LLM Applications 2026: the list and what changed

The OWASP GenAI Security Project released the 2026 edition of its Top 10 for LLM Applications on August 3, 2026. It ships as a 122-page PDF. When we checked on November 15, 2026, the project’s main list page at genai.owasp.org still showed the 2025 entries, and so did many of the pages that rank for “OWASP LLM Top 10”. This page has the 2026 list, what moved, and the ID changes that matter if your tests, tickets or policies cite the old numbers.

The 2026 list next to 2025

What moved, and why OWASP says it moved

OWASP says the order moved more this time than in earlier editions. According to its summary, Excessive Agency rose to third, which OWASP calls the most consequential move on the list: practitioner votes and the incident record both point to agentic deployments as the place where damage is landing. Unbounded Consumption rose four places to sixth, because practitioners rated cost and resource exhaustion higher than its old rank. Improper Output Handling fell the furthest, from fifth to tenth.

Prompt Injection stayed first and Sensitive Information Disclosure stayed second; OWASP says the second spot is where its confidence is highest. System Prompt Leakage became Hidden Context Exposure, which OWASP describes as a broader frame for the same failure.

OWASP describes the 2026 list as the first to check practitioner judgment against the record of real incidents, each against the other.

Entries that grew without new numbers

OWASP folded newer risks into existing entries instead of adding thin new categories:

• Prompt Injection now includes cross-modal attacks, where the instructions hide in an image or audio.
• Supply Chain now covers a promoted model artifact that isn’t what it claims to be.
• Data and Model Poisoning now absorbs fine-tuning subversion.
• Improper Output Handling now spans insecure code that coding assistants generate.

Eight IDs that now mean something else

If you map controls, test cases or findings to OWASP IDs, the numbers are the trap. Only LLM01 and LLM02 kept their meaning. LLM03 through LLM10 all point to different risks in 2026, as the table above shows. Two examples: a 2025 finding filed under LLM06 was about Excessive Agency, while LLM06:2026 is Unbounded Consumption, and a 2025 ticket for LLM03 was about the supply chain, while LLM03:2026 is Excessive Agency.

Writing the year with the ID, as OWASP does (LLM03:2026), removes the ambiguity. The register on this site always uses the 2026 IDs and shows the year.

Where the LLM list stops

OWASP draws a line in the 2026 introduction. This list owns the risk while the model is a component inside your application. Once the model becomes an actor, with tools it can call, memory it carries between sessions and consequences it sets off downstream, OWASP sends you to the Top 10 for Agentic Applications, published December 9, 2025. Many real incidents sit on that boundary, so read the two together if you run agents.

Appendix A of the 2026 PDF maps each entry to the Agentic list, MITRE ATLAS, MITRE ATT&CK, CWE, NIST AI 600-1, the NIST AI RMF, the CSA AI Controls Matrix and OWASP’s AIVSS. We put the Agentic, ATLAS and NIST columns into a browsable crosswalk.

Using the 2026 list

The list gives you names for risks. To turn it into work for your organization, start from what you actually run. The register builder filters the ten entries, plus five risks the list leaves to other documents, by the AI you use, and exports them with controls and vendor questions.