The OWASP LLM Top 10 named ten security risks for large language model applications in its 2025 edition. OWASP has since published a 2026 edition with different names and rankings, so builders should treat the 2025 list as a dated framework—not the current release. For AI agents, the key lesson is to limit what a model can access and do: narrow tool permissions, keep sensitive actions under human approval, and monitor tool use.
What is the OWASP LLM Top 10?
It is OWASP’s overview of major security risks in applications built with large language models. The list gives teams a shared vocabulary for identifying weaknesses across inputs, data, models, outputs, connected tools, and operations. It is a risk framework, not a ranking of guaranteed attack frequency or a substitute for application-specific threat modeling.
As an Amazon Associate I earn from qualifying purchases.
For agent builders, the risks matter because a model may not only generate text: it may retrieve information, call tools, and repeat model calls as it works through a task. A failure in the model or surrounding application can therefore lead to a real system action.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhat are the OWASP LLM risks for 2025?
OWASP’s archived 2025 edition lists these ten risks, in its published order:
#1 Best Overall
- LLM01:2025 — Prompt Injection: malicious or unintended instructions in input can influence model behavior.
- LLM02:2025 — Sensitive Information Disclosure: an application may reveal private or sensitive information through its responses or behavior.
- LLM03:2025 — Supply Chain: risks can enter through components, services, or other dependencies used to build or operate the application.
- LLM04:2025 — Data and Model Poisoning: compromised or manipulated training or other data can undermine model behavior.
- LLM05:2025 — Improper Output Handling: unsafe handling of model output can expose downstream systems to harm.
- LLM06:2025 — Excessive Agency: an application gives an LLM too much functionality, permission, or autonomy.
- LLM07:2025 — System Prompt Leakage: system instructions may be exposed, though those instructions should not be treated as a secure place to store secrets.
- LLM08:2025 — Vector and Embedding Weaknesses: weaknesses in retrieval systems and their data representations can create security problems.
- LLM09:2025 — Misinformation: a model may produce inaccurate information that users or connected systems rely on.
- LLM10:2025 — Unbounded Consumption: poorly bounded use can drive excessive resource consumption or cost.
These labels describe different points in an application’s risk surface. For an agent, evaluate not only the model’s response but also the data it can retrieve, the outputs it passes onward, the tools it can invoke, and the workflow that connects those parts.
What changed in the OWASP LLM Top 10 for 2026?
OWASP’s canonical release README identifies the 2026 edition, published August 4, 2026, as the current LLM list. It changes the ordering and names. In the new list, Excessive Agency is LLM03:2026 rather than LLM06:2025, and Hidden Context Exposure appears as LLM08:2026; System Prompt Leakage is a 2025 label, not a 2026 category with the same name.
| 2026 rank and label | 2025 rank and label |
|---|---|
| LLM01:2026 — Prompt Injection | LLM01:2025 — Prompt Injection |
| LLM02:2026 — Sensitive Information Disclosure | LLM02:2025 — Sensitive Information Disclosure |
| LLM03:2026 — Excessive Agency | LLM06:2025 — Excessive Agency |
| LLM04:2026 — Supply Chain | LLM03:2025 — Supply Chain |
| LLM05:2026 — Data and Model Poisoning | LLM04:2025 — Data and Model Poisoning |
| LLM06:2026 — Unbounded Consumption | LLM10:2025 — Unbounded Consumption |
| LLM07:2026 — Misinformation | LLM09:2025 — Misinformation |
| LLM08:2026 — Hidden Context Exposure | LLM07:2025 — System Prompt Leakage |
| LLM09:2026 — Vector and Embedding Weaknesses | LLM08:2025 — Vector and Embedding Weaknesses |
| LLM10:2026 — Improper Output Handling | LLM05:2025 — Improper Output Handling |
OWASP says the 2026 edition’s updated rankings and expanded threat coverage draw on thousands of real-world AI security incidents, and that the framework maps risks to NIST, MITRE ATLAS, CWE, and OWASP’s Agentic Applications Top 10. That description does not mean every category has a quantified prevalence estimate. Keep the year attached to a risk code when documenting findings or comparing guidance: ranks and labels are not stable across editions.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →How does the OWASP Top 10 apply to AI agents?
The LLM list covers risks in LLM applications broadly. OWASP also publishes a separate Top 10 for Agentic Applications, which focuses on risks arising from agent behavior and system design. It complements the LLM list rather than replacing it. Its 2026 categories are:
Rank #3
- Agent Goal Hijack
- Tool Misuse and Exploitation
- Identity and Privilege Abuse
- Agentic Supply Chain Vulnerabilities
- Unexpected Code Execution
- Memory and Context Poisoning
- Insecure Inter-Agent Communication
- Cascading Failures
- Human-Agent Trust Exploitation
- Rogue Agents
This second lens is useful when the main question is not simply whether a model can be induced to produce an unsafe response, but whether an agent can be diverted, misuse a capability, act with excessive privilege, or trigger failures across a workflow. OWASP’s agent guide describes its list as a practical entry point that references the LLM list and other standards.
How do you limit what an AI agent can do?
OWASP’s 2025 Excessive Agency guidance identifies three root causes: excessive functionality, excessive permissions, and excessive autonomy. Reduce each directly rather than relying on a prompt to make an overpowered tool safe.
Give tools only the functionality the task needs
Expose narrow, purpose-built operations rather than broad tools that can perform unrelated actions. If an agent only needs to summarize email, it should not also receive an unrestricted ability to send, delete, or forward messages.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Scope permissions to the smallest useful boundary
Use least privilege for accounts, data, and APIs. In OWASP’s email-assistant example, malicious content in an email can manipulate a summarizer that has the ability to send mail. A read-only scope reduces the actions available if the model is influenced by that content.
Best Value
Require human approval for high-impact actions
Keep a person in the decision loop for sensitive, destructive, or consequential operations. In the email example, approval before sending limits the chance that manipulated content becomes an outgoing message.
Keep autonomy bounded and observe downstream activity
Limit how long an agent can operate, how many steps or tool calls it can make, and what conditions allow it to continue. Monitor the agent’s goals and tool activity so unexpected behavior can be detected before it expands into a broader failure. OWASP’s agent guidance warns that unnecessary autonomy expands the attack surface and that limited visibility can allow small problems to grow.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should builders use the two OWASP lists?
Use the LLM Top 10 to review risks in the application’s model-facing and data-handling components, then use the Agentic Applications Top 10 to examine capabilities, identities, orchestration, and interactions among agents and tools. For each finding, record the edition and category, where the weakness enters, the likely effect on confidentiality, integrity, availability, or cost, and which layer needs a control: the model, application, connected tool, or operational process.
OWASP’s 2026 announcement reports more than 10,000 downloads in the first 48 hours and more than 30,000 LinkedIn members for the project. Those figures describe project reach, not how often a risk occurs or whether a particular mitigation is effective.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
