OWASP Top 10 for Large Language Model Applications

Applies To

Overview

The OWASP (Open Worldwide Application Security Project) Top 10 for LLM Applications is a community-built security list. It names the most critical weaknesses in systems built on large language models (LLMs), the AI behind chatbots and writing assistants. It is now maintained by the OWASP GenAI Security Project. The first list came out in 2023, the second in November 2024 as the 2025 edition, and the current one on 4 August 2026. The 2026 list, in order, covers prompt injection (inputs that override the model's instructions), sensitive information disclosure, and excessive agency (AI given more power to act than it needs). Next come supply chain weaknesses in third-party models and components, data and model poisoning, and unbounded consumption (runaway usage that drives up cost or knocks a service over). The rest are misinformation, hidden context exposure, vector and embedding weaknesses, and improper output handling. Hidden context exposure replaces the 2025 entry on system prompt leakage. It covers anything the model can see but the user should not, including system prompts, retrieved documents, agent memory, and tool responses. Each entry describes the risk, example attacks, and ways to reduce it. The list is meant to sit alongside existing application security practice. It covers risk when the model is a component inside an application; agents that act on their own are covered by the separate OWASP Top 10 for Agentic Applications, first published in December 2025.

Key Requirements

• •Implement input validation and output sanitization for all LLM interactions
• •Establish access controls limiting what actions LLM-powered systems can take
• •Monitor for prompt injection and anomalous model behavior in production
• •Apply least-privilege principles to AI agent permissions
• •Conduct supply chain due diligence on third-party models and plugins

What Your Organization Must Do

• →Map your LLM applications against the ten risks named in the 2026 OWASP list.
• →Prioritize prompt injection, sensitive information disclosure, and excessive agency in security testing plans.
• →Restrict AI agent permissions and tool access to the minimum each task needs.
• →Review what the model can see, including system prompts, retrieved documents, agent memory, and tool responses.
• →Ask third-party model and plugin vendors how they address supply chain and output handling risks.
• →Use this voluntary list to make NIST AI RMF or ISO 42001 testing steps concrete.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Governance Controls

Operational controls that implement requirements from this regulation.

Frequently Asked Questions

Is the OWASP LLM Top 10 a mandatory compliance requirement or a voluntary framework?

The OWASP LLM Top 10 is voluntary, community-built guidance with no enforcement mechanism. It is often referenced in procurement requirements, security audits, and regulator guidance, so alignment is increasingly expected.

What changed in the 2026 edition of the OWASP LLM Top 10?

The 2026 edition, published on 4 August 2026, moves excessive agency up to third place. It replaces system prompt leakage with hidden context exposure, which also covers retrieved documents, agent memory, and tool responses. Improper output handling drops to tenth. The 2025 edition had earlier replaced overreliance with misinformation and broadened model denial of service into unbounded consumption.

How does prompt injection in the OWASP LLM Top 10 differ from traditional SQL injection?

Prompt injection uses natural-language input to override an LLM's instructions, rather than exploiting a structured query parser. It is harder to catch with ordinary input validation because the attack is plain text, not a defined syntax.

Which OWASP LLM Top 10 risk is most relevant for companies deploying AI agents with tool access?

Excessive agency, now third on the list, covers LLM features with more permissions or capabilities than their task needs. Least-privilege access and narrowly scoped tools are the main defenses. For agents that act on their own, OWASP points to its separate Top 10 for Agentic Applications.

Does the OWASP LLM Top 10 apply to companies using third-party LLM APIs rather than self-hosted models?

Yes, several risks apply directly to organizations that use third-party LLM services. These include supply chain weaknesses, sensitive information disclosure, hidden context exposure, and improper output handling. You do not need to own the model for the list to be relevant.

How should compliance teams use the OWASP LLM Top 10 alongside existing frameworks like NIST AI RMF or ISO 42001?

The OWASP LLM Top 10 is a technical security reference that complements risk and governance frameworks. Use it to turn the testing and risk treatment steps of the NIST AI RMF or ISO 42001 into specific application security controls.