OWASP updates top 10 security risks for LLM applications

The OWASP GenAI Security Project has released its 2026 Top 10 for Large Language Model Applications, updating its guidance as AI systems become more autonomous, interconnected and embedded in enterprise workflows.

Prompt injection remains the No. 1 risk on the list, followed by sensitive information disclosure and excessive agency. The remaining categories cover supply chain risks, data and model poisoning, unbounded consumption, misinformation, hidden context exposure, vector and embedding weaknesses, and improper output handling.

The updated list reflects the growing use of AI agents and retrieval-augmented generation, or RAG, alongside changes in the techniques attackers can use against LLM applications.

One notable area is excessive agency, which addresses risks created when AI systems receive more functionality, permissions or autonomy than necessary. Those concerns have become more significant as organizations deploy AI agents capable of interacting with external tools, systems and data.

Supply chain security is another focus. OWASP said LLM supply chains extend beyond conventional software dependencies to include third-party models, training data, adapters and model artifacts. Attackers could manipulate those components through poisoning, tampering or malicious replacements, potentially causing security breaches, biased outputs or system failures.

Related reading:

The 2026 edition also identifies hidden context exposure as a distinct risk. Hidden context can include system prompts, developer instructions, tool schemas and policy information supplied to an AI model but not intended for users. OWASP advises developers to assume that such information could be discovered and avoid storing credentials, tokens or other secrets there. Hidden context also should not serve as the sole security control for authorization or policy enforcement.

Another category, vector and embedding weaknesses, focuses on technology underpinning RAG, AI memory and semantic search. Weaknesses in that layer can enable attackers to poison retrieval results, extract information or exploit improperly separated data. In multi-tenant systems, for example, attackers may be able to infer information about other customers' documents even when authentication controls are in place.

The guidance also emphasizes that AI security risks increasingly overlap. Data and model poisoning can manipulate recommendations and business decisions, while misinformation can contribute to operational disruption and poor human decision-making.

OWASP mapped the 10 risks against nine external security frameworks and taxonomies, including MITRE ATLAS and ATT&CK, to help organizations incorporate LLM security into existing risk-management programs.

Read the OWASP Top 10 for LLM Applications 2026 here.