{"post":{"slug":"owasp-llm-top-10-explained-2026","title":"OWASP LLM Top 10 Explained in 2026: AI Risks Ranked","excerpt":"OWASP's dedicated Top 10 for LLM applications covers risks the general web list misses, like prompt injection and vector store leakage. Here is the current revision explained category by category.","category":"code","date":"August 7, 2026","author":"ByteLedger Team","content":"<span class=\"dropcap\">O</span>WASP maintains a dedicated Top 10 for large language model applications, separate from the general web application list, because LLM-specific systems fail in ways that traditional web risk categories do not fully capture. A SQL injection checklist does not tell you anything about a retrieval pipeline leaking another tenant's documents through embedding similarity, or an agent with too much tool access taking an unintended action after a manipulated prompt. The 2025 revision of the list reorganized several categories based on real incident data gathered since the original 2023 release.\n\n## What changed in 2026\n\n- **System Prompt Leakage is now its own category**, reflecting how often system prompts — sometimes containing business logic or credentials — get extracted through careful querying and then used to craft more effective attacks.\n- **Vector and Embedding Weaknesses joined the list**, covering RAG-specific risks like embedding inversion and cross-tenant retrieval leakage in shared vector stores, a gap the original 2023 list did not address.\n- **Unbounded Consumption replaced the narrower Model Denial of Service category**, broadening scope to cover cost-based attacks (denial-of-wallet) alongside pure availability attacks.\n- **Insecure Plugin Design and Model Theft dropped as standalone categories**, with their concerns folded into Excessive Agency and Supply Chain, reflecting how \"plugins\" became \"tools\" in a broader agentic context.\n- **Misinformation replaced Overreliance**, shifting the framing from a human-behavior problem to a model-output-quality problem that applications need to actively guard against.\n\n## The ten categories\n\n| Rank | Category | What it covers |\n| --- | --- | --- |\n| LLM01 | Prompt Injection | Crafted input, direct or via retrieved content, overrides the application's intended instructions |\n| LLM02 | Sensitive Information Disclosure | Model reveals PII, secrets, or proprietary data from training data or context |\n| LLM03 | Supply Chain | Compromised training data, pretrained models, or third-party tools and libraries in the pipeline |\n| LLM04 | Data and Model Poisoning | Manipulated training or fine-tuning data introduces backdoors, bias, or degraded behavior |\n| LLM05 | Improper Output Handling | Downstream systems trust model output without validation, enabling XSS, SSRF, or code execution |\n| LLM06 | Excessive Agency | Model or agent granted more permissions, tools, or autonomy than the task requires |\n| LLM07 | System Prompt Leakage | Attacker extracts the system prompt, exposing logic or embedded secrets |\n| LLM08 | Vector and Embedding Weaknesses | RAG-specific risks: embedding inversion, unauthorized retrieval, cross-tenant leakage |\n| LLM09 | Misinformation | Model produces plausible but false output that users or downstream systems over-trust |\n| LLM10 | Unbounded Consumption | Uncontrolled resource or cost usage from expensive queries, denial-of-wallet, or denial-of-service |\n\n## Why this list needs to be read alongside the general Top 10\n\nNone of these ten categories retire standard web application risk. An LLM feature still runs inside a web application: it has authentication, authorization, logging, and dependencies, all covered by the [general OWASP Top 10](/blog/owasp-top-10-explained-2026). LLM06, Excessive Agency, for instance, is really an access-control problem (A01 in the general list) applied to a new kind of principal — the model itself acting on a user's behalf. Reading the LLM list in isolation and assuming it replaces standard application security review is itself a category of the mistake OWASP is trying to prevent.\n\n## Common mistakes\n\n**Treating Prompt Injection as fully solvable.** No current technique reliably prevents it; the realistic goal is limiting what an attacker gains if injection succeeds, through scoped permissions and output validation — see [LLM security best practices](/blog/llm-security-best-practices-2026) for concrete controls.\n\n**Ignoring Vector and Embedding Weaknesses in multi-tenant RAG.** A shared vector index without per-tenant filtering at query time can return another customer's documents in a similarity search, regardless of how careful the prompt is.\n\n**Granting broad tool access \"to keep things flexible.\"** Excessive Agency is rarely a deliberate decision — it accumulates as more tools get added to an agent without revisiting whether each one still needs the access it was given.\n\n**Skipping cost controls until a bill spikes.** Unbounded Consumption is often discovered in a billing statement, not a security review — cap tokens, request rate, and context size per user before shipping, not after.\n\n## FAQ\n\n**Is the OWASP LLM Top 10 different from the general OWASP Top 10?**\nYes, it is a separate list maintained for AI and LLM-specific risks, meant to complement rather than replace the general web application Top 10.\n\n**What is the single most exploited category?**\nPrompt Injection (LLM01), consistently, because it requires no special access, just the ability to influence any text the model reads.\n\n**Does using a well-known provider like OpenAI or Anthropic cover these risks?**\nNo. Provider-level safety training reduces some risks but application-level issues — RAG access control, tool permission scope, output handling, cost caps — remain the deploying team's responsibility.\n\n**What is Excessive Agency in practice?**\nGiving an agent more standing permissions or autonomous action capability, like sending emails, executing code, or spending money, than the specific task requires, which turns a successful prompt injection into a real-world action instead of just bad text.\n\n## Where to go next\n\n- [LLM security best practices in 2026](/blog/llm-security-best-practices-2026)\n- [OWASP Top 10 explained in 2026](/blog/owasp-top-10-explained-2026)\n- [Best LLM frameworks in 2026](/blog/best-llm-frameworks-2026)","hue":316,"metaTitle":"OWASP LLM Top 10 Explained 2026: AI Risks","metaDescription":"OWASP LLM Top 10 explained for 2026: prompt injection, excessive agency, vector and embedding weaknesses, and every category in the 2025 revision.","keywords":["owasp llm top 10 explained 2026","owasp top 10 for llm applications","prompt injection owasp","excessive agency llm","llm application security risks","vector and embedding weaknesses","owasp genai security"],"tldr":["**The 2025 revision reorganized the list around real incidents** — System Prompt Leakage and Vector and Embedding Weaknesses are new categories that did not exist in the original 2023 list.","**Prompt Injection still ranks first** — it remains the most exploited and hardest-to-fully-prevent risk in LLM applications.","**Excessive Agency is the one that matters most for agentic systems** — it covers giving a model more tools, permissions, or autonomy than a task actually needs.","**RAG pipelines get their own category now** — Vector and Embedding Weaknesses covers embedding inversion and cross-tenant retrieval leakage that the 2023 list did not address directly.","**Skip:** treating this list as separate from general web security — most LLM applications still need the standard OWASP Top 10 controls on top of these AI-specific risks."],"readTime":"4 min read","wordCount":873},"related":[{"slug":"owasp-top-10-explained-2026","title":"OWASP Top 10 Explained in 2026: Web Risks Ranked","excerpt":"The OWASP Top 10 ranks the most critical web application security risks, from broken access control to SSRF. Here is what each category means in 2026 and how to actually use the list.","category":"code","date":"August 7, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":314},{"slug":"llm-security-best-practices-2026","title":"LLM Security Best Practices in 2026: A Practical Guide","excerpt":"Securing an LLM-integrated application means assuming the model cannot tell trusted instructions from untrusted data. Here are the 2026 practices that actually reduce risk, from tool scoping to RAG access control.","category":"code","date":"August 6, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":312},{"slug":"ai-coding-security-risks-2026","title":"AI coding security risks in 2026: what to check before you ship","excerpt":"AI writes plausible code that quietly ships bugs and secrets. These are the real security risks of AI-assisted coding in 2026 and how to defend against them.","category":"code","date":"May 2, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":6}],"sameCategory":[{"slug":"bazel-build-explained-2026","title":"Bazel Explained: What Hermetic Builds Actually Cost","excerpt":"Bazel delivers reproducible, precisely cached builds and demands that you describe everything. Here is what you get, what it costs, and who should say no.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":145},{"slug":"graphql-federation-2026","title":"GraphQL Federation: One Graph, Many Teams","excerpt":"Federation composes independently-owned subgraphs into a single API. Here is what it solves, the operational cost it adds, and when a simpler gateway is enough.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":300},{"slug":"hermetic-builds-explained-2026","title":"Hermetic Builds Explained: Same Inputs, Same Output","excerpt":"A hermetic build depends only on declared inputs. Here is what that property gives you, the common leaks that break it, and how to move toward it incrementally.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":130},{"slug":"monorepo-tooling-compared-2026","title":"Monorepo Tooling Compared: What You Actually Need","excerpt":"Monorepo tools solve task orchestration and caching, not repository layout. Here is what each tier provides and how to tell when you have outgrown the simple option.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":150}],"newer":{"slug":"outbox-pattern-explained-2026","title":"Outbox Pattern Explained in 2026: Reliable Publishing","excerpt":"Writing to a database and publishing an event are two separate operations that can fail independently. Here is how the outbox pattern closes that gap and how to build the relay in 2026.","category":"code","date":"August 7, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":308},"older":{"slug":"owasp-top-10-explained-2026","title":"OWASP Top 10 Explained in 2026: Web Risks Ranked","excerpt":"The OWASP Top 10 ranks the most critical web application security risks, from broken access control to SSRF. Here is what each category means in 2026 and how to actually use the list.","category":"code","date":"August 7, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":314}}