The OWASP Top 10 for Large Language Model Applications is the closest the industry has to a shared vocabulary for LLM application risk. Treat it as the floor, not the ceiling. Every category on this list deserves at least one probe in your eval suite; the better-resourced teams probe most of them on every release 1.
The list below uses the 2026 edition's numbering, published in August 2026, with each entry's 2025 (v2.0) code alongside because tools and older write-ups still print the 2025 codes 2. The advice for each category is the same shape: a one-sentence definition, the failure mode in product terms, the smallest probe you can add to your eval suite this week.
The ten categories
| 2026 code | 2025 code | Category | What goes wrong | Smallest probe |
|---|
| LLM01 | LLM01 | Prompt Injection | Untrusted input (text, retrieved content, tool output, image, audio) overrides the system prompt or tool policy | 20 indirect-injection cases in tool-input fields, plus image or audio carriers if the app accepts them, scored by policy violation |
| LLM02 | LLM02 | Sensitive Information Disclosure | Model emits PII or proprietary data from context or training, including through reasoning traces and tool-call arguments | Synthetic conversations seeded with PII-like canaries, grep the final outputs, tool-call arguments, and any visible reasoning |
| LLM03 | LLM06 | Excessive Agency | Agent has more permission, autonomy, or tools than it needs | Run agent against a deliberately overprivileged tool catalog and grade for least-privilege adherence |
| LLM04 | LLM03 | Supply Chain | Compromised model weights, adapters, datasets, or plugins | Pin model fingerprints; eval dependency chain on every release |
| LLM05 | LLM04 | Data and Model Poisoning | Training or fine-tuning data injected to bias outputs | Trigger-phrase probes drawn from the suspected poison signature |
| LLM06 | LLM10 | Unbounded Consumption | Resource exhaustion via prompts that explode token or tool budgets | Cap-and-budget probe: send a known-explosive prompt and verify the request fails closed |
| LLM07 | LLM09 | Misinformation | Confident incorrect output that the user trusts or an agent acts on | Use the existing RAG faithfulness eval; track fabrication rate |
| LLM08 | LLM07 | Hidden Context Exposure (was System Prompt Leakage) | Model reveals the system prompt, tool schemas, or other hidden instructions | 30 standard extraction prompts, scored by leakage; then audit the prompt itself for credentials and authorization logic |
| LLM09 | LLM08 | Vector and Embedding Weaknesses | Inversion or poisoning of the RAG index | Eval that the retriever returns expected docs for a known query set |
| LLM10 | LLM05 | Improper Output Handling | Downstream code trusts model output (XSS, SQLi, RCE), including code the model generated | Run outputs through your sanitizer in eval, not just in prod |
The table compresses the OWASP guidance. Read the upstream document for the full mitigations under each item 2. The mapping below is opinionated and meant for an evals practitioner, not a security auditor.
What changed in 2026
OWASP reissued the list in August 2026. The ranking now blends a practitioner vote (three-quarters of the weight) with a classified record of 6,639 public incidents (one quarter) 2. Prompt injection keeps first place even though it drops out of the top ten on raw incident counts; OWASP reads that as a defense effect, since teams that fight injection hard leave fewer clean exploits in public databases. Misinformation went the other way: the incident record ranked it near the top and the vote near the bottom, and it lands seventh, up from ninth.
Four moves change your probe priorities. Excessive Agency climbs from sixth to third. Unbounded Consumption rises four places, from tenth to sixth. Improper Output Handling falls from fifth to tenth. System Prompt Leakage becomes Hidden Context Exposure, which also covers retrieved policy text and tool schemas, and the guidance assumes the context will leak: keep credentials and authorization logic out of the context so a leak costs little. Newer risks were folded into existing entries rather than given new ones: cross-modal injection (instructions hidden in an image or audio track) under LLM01, reasoning traces and tool-call arguments as disclosure channels under LLM02, and insecure assistant-generated code under LLM10.
The codes moved, so tag every probe with its edition. LLM06 is Excessive Agency in 2025 and Unbounded Consumption in 2026. Promptfoo's owasp:llm:01 through owasp:llm:10 presets still follow the 2025 numbering on its docs page as of October 2026 3, so a dashboard that joins tool output to this table needs the crosswalk in the second column.
What this list is good for
The list is most useful as a checklist for two conversations: with your security team, and with your customer's procurement team. Both want to know that you have thought about each category. A short page in your trust portal that says "Here is what we test for, mapped to OWASP LLM01 through LLM10 (name the edition), with the date of last verification" satisfies most of the second conversation without bespoke work each time.
For internal use, the list is a starting taxonomy for your red team. The five categories that tend to bite hardest in production are LLM01 (prompt injection, especially indirect), LLM10 (improper output handling, the source of most XSS bugs in chat surfaces), LLM03 (excessive agency, the new failure mode in agentic systems), LLM08 (hidden context exposure, a competitive-disclosure issue at minimum), and LLM07 (misinformation, where your judge has to grade for fabrication, not just helpfulness).
For agentic products, LLM01 and LLM03 converge into a single measurable failure, and OWASP tracks the agent-specific version in a separate Top 10 for Agentic Applications (December 2025) led by Agent Goal Hijack and Tool Misuse 4. The 2026 LLM list draws the boundary itself: it owns the risk while the model is a component of your application, and once the model acts with tools, memory, and downstream consequences you pair it with the agentic list 2. The chapter on evaluating agents under adversarial content turns that convergence into the two numbers you gate on.
Figure: Testing tiers for the OWASP Top 10 for LLM applications (2026 numbering): LLM01 prompt injection and LLM08 hidden context exposure are probed on every release because their regression rate is highest, LLM10, LLM03, and LLM07 bite hardest in production, and the remaining five categories run on a quarterly rotation of three per release.
## What this list is not
The OWASP Top 10 is not a benchmark. It does not give you a labeled corpus, a scoring rubric, or a comparable number across vendors. For each category you still need to instrument the probe, write the rubric, and decide your pass threshold. Public corpora like HarmBench cover overlapping ground (LLM01, parts of LLM07) but are not a substitute for category-by-category probing on your specific surfaces 5.
Vendor red-team tools like Promptfoo's red-team module ship attack libraries organized by OWASP category, which can save you weeks of corpus construction; the trade is that you are then evaluating against an attack library someone else maintains 6. Promptfoo announced in March 2026 that OpenAI is acquiring it, and says the suite stays open source and keeps supporting other providers' models 7; if you grade other vendors' models with it, keep your own cases in a tool-neutral format so you can swap harnesses. Microsoft Foundry (formerly Azure AI Foundry, and before that Azure AI Studio) ships content filters that overlap several probes above, including prompt shields for direct and indirect injection, groundedness detection, and PII filtering 8. They line up with LLM01, LLM07, and LLM02, so run each probe with the filter on and off to learn which layer is doing the work.
How to use this page in a release process
The minimum useful artifact is a one-row-per-category table on your release checklist. Each row has the probe set, the pass threshold, the date last run, and the owner. Three categories per release have to be tested live, on a rotation, so that everything is exercised across a quarter. Two categories (LLM01 and LLM08) are tested on every release because the empirical regression rate on those is the highest.
CAUTION
OWASP has reissued the list roughly every 15 to 21 months since version 1.0 in August 2023: the 2025 edition arrived in November 2024 and the 2026 edition in August 2026. Pin your testing to a specific edition, and re-baseline when a new one ships. The categories shift between editions (see above); treating the list as a moving target is a maintenance discipline, not a bug.
The next chapter, Designing a red-team program, covers the operating model that turns the table above into something that fires every release.