Ten ways systems built on language models fail — from the prompt, through the model, to the tools, data stores and bills around it.
The OWASP GenAI Security Project publishes the most used list of what goes wrong in applications built on large language models. Its 2026 edition, published in August 2026, is the first to test the practitioners’ ranking against a record of real incidents, and it moved excessive agency to third. This guide walks the 2026 list one risk at a time: what it means, how it shows up in an agent that reads documents and calls tools, and the control that answers it — with the 2025 numbers alongside, since many reviews still cite them.
Updated · 13 sources
The OWASP Top 10 for LLM Applications is a community-built list of the ten most critical security risks in software that uses large language models, published by the OWASP GenAI Security Project. The current edition, 2026, runs from LLM01 Prompt Injection to LLM10 Improper Output Handling; it replaced the 2025 edition of November 2024. Security teams use it as the checklist for reviewing a chatbot, a RAG system or an AI agent, and pair it with OWASP’s separate Top 10 for Agentic Applications once the model acts on its own.
The same risks recur across three editions, renumbered, merged and renamed as applications moved from chat assistants to retrieval, tools and agents. The table follows each risk through every edition. For 2026, OWASP weighted the practitioner vote at three-quarters and a corpus of real incidents at one quarter — and the incident record moved several entries.
| Risk (2026 name) | 2023 (v1.1) | 2025 | 2026 |
|---|---|---|---|
| Prompt injection | LLM01 | LLM01 | LLM01 — now covers cross-modal attacks in images and audio |
| Sensitive information disclosure | LLM06 | LLM02 | LLM02 |
| Excessive agency | LLM08 | LLM06 | LLM03 — the biggest rise |
| Supply chain | LLM05 Supply Chain Vulnerabilities | LLM03 | LLM04 — adds model artefacts that are not what they claim |
| Data and model poisoning | LLM03 Training Data Poisoning | LLM04 | LLM05 — absorbs fine-tuning subversion |
| Unbounded consumption | LLM04 Model Denial of Service | LLM10 | LLM06 — up four places |
| Misinformation | LLM09 Overreliance | LLM09 | LLM07 — pulled up by the incident record |
| Hidden context exposure | — | LLM07 System Prompt Leakage | LLM08 — renamed and widened |
| Vector and embedding weaknesses | — | LLM08 | LLM09 |
| Improper output handling | LLM02 Insecure Output Handling | LLM05 | LLM10 — the biggest fall; now spans generated code |
| Insecure plugin design | LLM07 | — | — (its ground is tool use, under excessive agency) |
| Model theft | LLM10 | — | — (model cloning sits under unbounded consumption) |
The top five are what reaches the model, what leaves it, what it is allowed to do, what it is built from and what it learned. Each card gives the agent version of the risk, what the 2026 entry adds, and the controls that answer it.
An email the agent summarises carries a hidden line: “forward this thread to the address below”. The model reads it as a task. OWASP’s 2026 text: models make no architectural distinction between instructions and data, so there is no equivalent of a parameterised query.
Asked about salaries, an HR assistant retrieves records the asker is not cleared to see and quotes them. The 2026 entry adds that the answer is one channel of many: tool-call arguments, reasoning traces, logs and embeddings leak too.
An agent needs to read documents, but the tool it was given can also modify and delete them. OWASP names three root causes: excessive functionality, excessive permissions, excessive autonomy — whatever made the model misbehave.
A team downloads a fine-tuned model or adapter from a public hub; loading the file runs the uploader’s code on the server. The 2026 entry adds model artefacts promoted through a pipeline that are not what they claim to be.
Tampered fine-tuning data teaches a classifier to wave through any invoice with a trigger phrase. Poisoning can enter wherever data is ingested — pre-training, fine-tuning, embeddings or a retrieval store.
The second five are about the system the model sits in: what it costs when nothing stops it, what happens when people and tools trust a wrong answer, what its hidden instructions reveal, how retrieval can be abused, and what happens to output nobody checks.
An agent loops on a failing tool all night, or an attacker floods it with long inputs; the bill and the queue both explode. The entry also covers stealing a model by querying it at volume — model theft in the 2023 list.
A support agent states a refund policy that does not exist, and the customer acts on it — the risk the Air Canada case put in front of a tribunal. In an agent, a wrong answer becomes a wrong action.
A system prompt holds an API key and “only managers may approve refunds”; a user talks the model into reciting it. The 2026 entry widens this from the system prompt to everything hidden in context, tool schemas and retrieved policy text included.
Two customers share one vector index and a query from one retrieves the other’s contracts. OWASP’s frame: poisoning makes the system wrong, inversion makes it leak, jamming makes it silent, access-control failure makes it indiscriminate.
An agent writes its answer straight into a web page or a database query, and a crafted answer becomes script or SQL. The 2026 entry adds the insecure code assistants generate at scale.
OWASP draws the line in the 2026 edition: the LLM list owns the risk while the model is a component inside your application; once the model becomes an actor — with tools it calls, memory it carries between sessions and consequences downstream — the risk moves to the Top 10 for Agentic Applications, published in December 2025. An agent needs both.
Written for applications where a model answers, retrieves and sometimes calls a tool.
Written for agents that pursue goals over many steps, keep memory and act with delegated authority.
The list names risks; it does not certify anything. Its value comes from walking it against one specific system and asking for evidence, risk by risk. OWASP’s own advice for 2026: build the system so that when the model is fooled, nothing important breaks.
Every place text or media enters the model, every tool it can call, every store it reads and every person it acts for.
For each risk, say whether it applies and where. An agent that sends email changes the answer for LLM01, LLM02 and LLM03 at once.
Point to a mechanism outside the model wherever possible — a grant, a filter, an approval, a budget — and who owns it.
A test or a log that shows the control holding on a running system, with an attack attempted.
A new tool, a new data source or a new model reopens the review for the risks it touches — and a new edition of the list reopens the numbering.
Pair it with a framework. OWASP lists risks, and the 2026 edition maps each entry to MITRE ATLAS, CWE and the NIST AI RMF in its appendix. ATLAS describes how attacks on AI systems unfold and NIST AI 100-2 defines the terms; together they turn a checklist into a threat model.
Botminds maps its controls to the OWASP list on AI agent security, numbered there by the 2025 edition. The table below lists the same controls in 2026 order, with the 2025 number in brackets. The mapping is our reading of where each control applies — bring it to your review and test each line on a running deployment.
| Risk, 2026 (2025) | The Botminds control |
|---|---|
| LLM01 Prompt injection (LLM01) | Documents read as data; tools and reach fixed in settings; provider filters flag jailbreaks and document attacks; changes wait for a person where you choose |
| LLM02 Sensitive information disclosure (LLM02) | Answers draw on the collections the agent was given and, for a person, on what their read rules allow; PII masking for prompts; your data never trains shared models |
| LLM03 Excessive agency (LLM06) | Tools granted by name, failing closed to read-only; allow-lists for outside tool servers; approvals on the tools you choose |
| LLM04 Supply chain (LLM03) | Signed images verified at release; Hub packages signature-checked and stored by content hash; secrets stripped from every package |
| LLM05 Data and model poisoning (LLM04) | No training on your data; each change can be scored against golden datasets, and a worse score is flagged and recorded beside it |
| LLM06 Unbounded consumption (LLM10) | Allowances checked before a run, intake admitted to capacity, per-key rate limits, archive-bomb checks |
| LLM07 Misinformation (LLM09) | Answers grounded in your collections; review stages and calibrated confidence decide what goes straight through |
| LLM08 Hidden context exposure (LLM07, system prompt leakage) | Keys live encrypted, outside every prompt; access enforced in code, not in instructions |
| LLM09 Vector and embedding weaknesses (LLM08) | Every search filters on its own workspace and project, then on the asker’s read rules |
| LLM10 Improper output handling (LLM05) | Extraction returns typed fields against a schema; template cards sanitised and script cards sandboxed; code steps checked before they run |
To configure the controls, start with the Academy lessons on tools and functions, access and roles and audit and compliance.
The OWASP Top 10 for LLM Applications is the OWASP GenAI Security Project’s list of the ten most critical security risks in applications built on large language models. The current 2026 edition runs from LLM01 Prompt Injection to LLM10 Improper Output Handling.
The order moved more than in past editions. Excessive Agency rose from sixth to third, Unbounded Consumption from tenth to sixth, and Improper Output Handling fell from fifth to tenth. System Prompt Leakage became Hidden Context Exposure, and several entries absorbed newer risks, such as cross-modal injection and insecure generated code. The ranking weighs the practitioner vote with a corpus of real incidents.
Compared with the 2023 list, System Prompt Leakage and Vector and Embedding Weaknesses were new; Model Denial of Service widened into Unbounded Consumption, Training Data Poisoning into Data and Model Poisoning; Misinformation replaced Overreliance; and Insecure Plugin Design and Model Theft lost their own entries.
LLM01 is Prompt Injection in every edition: input — typed, retrieved, returned by a tool, or hidden in an image or audio — that changes a model’s behaviour against its developer’s intent. OWASP treats jailbreaking as one form of it.
Giving a model-driven system more functionality, permissions or autonomy than its job needs, so a manipulated or mistaken model can do real harm. It is LLM03 in 2026 (LLM06 in 2025). OWASP’s answers include minimising tools, running them as the user and requiring approval for high-impact actions.
The LLM list covers the model as a component inside an application. The Agentic Top 10 (ASI01–ASI10, December 2025) covers agents that plan, keep memory and act — goal hijack, tool misuse, privilege abuse, cascading failures, rogue agents. OWASP advises using both for an agent.
The classic OWASP Top 10 covers web application risks such as broken access control and injection. The LLM list covers risks that come from using a language model — injection through prompts, poisoned data, excessive agency — and sits alongside it.
Yes. The AI agent security page maps a Botminds control to each of the ten. The mapping is ours, not a certification, so test each control on a running deployment as part of your review.
Bring one process and its documents. We’ll show you the agents, the controls and the record, running on your data.