OWASP LLM Top 10 2026: The New Rankings, What Changed, and What to Fix First

The list most teams use to frame AI security conversations changed in August, and much of the guidance still in circulation has not caught up. If your vendor questionnaire, AI policy, or awareness material still names System Prompt Leakage among the OWASP risks, it is working from the 2025 edition. The OWASP LLM Top 10 2026, published by the OWASP GenAI Security Project with a release date of August 4, 2026 in the canonical repository, renamed that entry, moved Excessive Agency into the top three, and made a quieter change that matters more than any ranking shuffle: for the first time, the list is partly grounded in empirical incident data rather than a practitioner vote alone.

The ranking moves are what people will share. The methodology change is what should change how you use the list.

The 2026 list, in order

The ten, as the canonical repository publishes them, with each entry’s 2025 position for comparison:

1. LLM01: Prompt Injection, held #1.
2. LLM02: Sensitive Information Disclosure, held #2.
3. LLM03: Excessive Agency, up from #6.
4. LLM04: Supply Chain, down from #3.
5. LLM05: Data and Model Poisoning, down from #4.
6. LLM06: Unbounded Consumption, up four from #10.
7. LLM07: Misinformation, up two from #9.
8. LLM08: Hidden Context Exposure, renamed and re-scoped from #7, System Prompt Leakage.
9. LLM09: Vector and Embedding Weaknesses, down from #8.
10. LLM10: Improper Output Handling, down five from #5.

The 2025 comparisons come from the OWASP archive index on genai.owasp.org; the 2026 ordering is the repository’s final list, whose README carries the line “Release date: August 4, 2026”. Don’t read the arrows as a priority ranking for your environment. With the community vote carrying most of the weight, an entry can fall because sentiment around it softened while the underlying exposure barely moved.

The vote now shares room with incident data

In the preface, the project leads are blunt about their earlier work: every previous version “was built on judgment”. That vote remains the spine of the 2026 list. What is new is the check. The project assembled a corpus of 7,714 real incidents from public vulnerability databases and an AI-harm database, classified the 6,639 that carried enough detail to sort, and asked one question: does what practitioners fear match the record?

In specific places it does not, and the disagreements are the useful part.

Prompt injection is the clearest case. It stays #1, but rank the categories by raw incident counts alone and it drops out of the top 10 entirely. The preface reads that as a defense effect: teams that fight injection hard produce fewer clean exploits for public databases, so the public count understates a risk mature teams already spend money holding off. That interpretation is OWASP’s own.

Misinformation runs the other way. Voters placed it near the bottom; the incident record placed it near the top, which the preface calls “the widest gap in the direction that actually hurts, where the vote sits low and the evidence sits high”. The entry settled at #7 because the vote holds the greater weight. When a fluent, confident model output drives a decision or a tool call, a wrong answer becomes a wrong action.

The project leads compressed their posture into four sentences, and the last is the operative one:

“Stop trying to build a model that cannot be fooled. Build the system around it, so that when the model is fooled, and it will be, nothing important breaks. That posture runs through all ten entries here. This year, for the first time, we can show you the evidence instead of asking you to take it on faith.”

Steve Wilson and Rock Lambros wrote that, and a list you can trace to a documented corpus is a list you can defend in a risk committee, which is the practical value of the change.

The move that matters: Excessive Agency at #3

Excessive Agency climbed from #6 to #3, and the preface calls it “the most consequential move on the list, because the vote and the record agree that agentic deployments are where the damage is landing.” If your company has shipped a copilot, a document-intelligence pipeline, or a customer-facing assistant that calls internal tools, this is the entry to read first.

Excessive Agency reduces to three root causes: excessive functionality (tools that can do more than the job needs), excessive permissions (service identities with rights the application never uses), and excessive autonomy (high-impact actions with no independent verification).

The mitigation list is a least-privilege review nobody ran: limit the tools, limit what each tool does, execute in the user’s context, require human approval for high-impact actions. One pattern worth stealing: auto-approve what is easily reversible, a refund issued as store credit; route what is irreversible, an external payout, to human review. Matching friction to reversibility survives cost pressure.

One boundary to keep straight. This list owns the failure when the model is a component inside your application. In the preface’s words: “The moment that model becomes an actor, with tools it can call, memory it carries between sessions, and consequences it sets in motion downstream, the risk moves to the OWASP Agentic Top 10.” Plenty of deployed systems already sit on that line; tool-layer and MCP control design is covered at https://ntdciso.com/insights/mcp-security-design-considerations/.

The rename: System Prompt Leakage is now Hidden Context Exposure

The 2025 list treated this as a narrow problem: the system prompt string leaks. The 2026 entry, LLM08, widens the lens to “unauthorized extraction, inference, or reconstruction of hidden, non-user-facing system instructions or operational context placed in a model’s context.” That covers retrieved policy text from RAG knowledge bases, tool and function schemas, authorization directives, and output-formatting rules, everything the application assembles around the model that no user is meant to see. The old name still dominates older checklists, so keep the mapping visible in your own materials.

The entry’s design rule belongs in your own standards. Assume hidden context is discoverable. Never embed credentials, connection strings, or tokens in it. Never rely on its secrecy as the security boundary for authorization, privilege separation, or content filtering. Severity tracks what actually sits in that context, up to critical where disclosure chains into code execution or broad data exfiltration.

For anyone running retrieval-based applications, the exposure is the whole assembly line feeding the context window, not just the system prompt.

Sharper entries, same ten buckets

OWASP folded newer risks into the entries that already owned them rather than minting new categories. In the preface’s words: “Standing up thin new categories would have splintered the list for no gain.”

Prompt Injection now covers cross-modal attacks, where instructions hide inside an image or an audio track. Supply Chain accounts for the trust failure when a promoted model artifact is not what it claims to be. Data and Model Poisoning absorbs fine-tuning subversion, and for retrieval systems it carries a number worth knowing: research cited by OWASP (Zou et al., 2025) found that as few as five poisoned documents have reached roughly 90% attack success against a knowledge base of millions of texts. Unbounded Consumption rose four places to #6, and the entry’s economics explain why: in pay-per-token environments, attackers can trigger “disproportionately expensive computation at negligible cost to themselves”, which turns cost abuse from an edge case into a budget line.

Improper Output Handling fell five places to #10 and now spans insecure generated code explicitly. Falling is not the same as fading. The exposure it describes, from XSS and SQL injection pathways to assistant-generated code reaching production, remains a direct route from model output to system compromise. What dropped is the expectation of severity, not the attack surface; treat the ranking movement as information, not permission to deprioritize.

What to do with the list

Inventory the GenAI applications you actually run, customer-facing chat, document intelligence, and internal copilots. For each, map which of the ten entries apply and what controls exist. The first finding is usually the same one: capabilities, credentials, and output handling were tuned for convenience during prototyping and never revisited at production review.

Use the mappings. Appendix A of the release maps the ten entries against NIST AI RMF (AI 100-1), the NIST Generative AI Profile (AI 600-1), MITRE ATLAS, ATT&CK, CWE, CSA’s AI Controls Matrix, OWASP’s agentic list, its GenAI Data Security document, and AIVSS. One caution for documentation: the release contains no ISO/IEC 42001 or 27001 mapping. A program structured around ISO 42001, as many now are during the AIMS certification wave documented at https://ntdciso.com/insights/iso-42001-aims-certification-wave/, can still adopt this taxonomy as its risk vocabulary; the list never claims an ISO mapping of its own.

Update the paper trail. Wherever a checklist or questionnaire quotes the 2025 entry names, refresh them and note the re-scopes so downstream teams compare current terms. In vendor review, the entry set gives better questions than “do you test for prompt injection”: which categories apply to the product, what evidence exists per category, where the vendor’s boundaries end. Assurance and model-risk programs have close versions of this problem, covered in our SOC 2 gap analysis at https://ntdciso.com/insights/soc2-ai-controls-gap/ and the GenAI model-risk carve-out discussion at https://ntdciso.com/insights/genai-model-risk-carve-out/.

Sequence the first fixes with the list’s own confidence signals. LLM02, Sensitive Information Disclosure, is what the preface calls “the one place at the top where belief and evidence simply agree, and where our confidence is highest”, so start there. LLM08 is often the cheapest to improve: move credentials out of context, externalize enforcement, stop relying on secrecy the model can leak. LLM03 is the structural one: audit tool scopes and service identities behind every deployed assistant; require approval for irreversible actions. The Appendix A mappings slot most naturally into reviews organized around the NIST AI RMF, which pairs with the quick-start framing in our NIST CSF piece at https://ntdciso.com/insights/nist-sp1353-ai-csf-quick-start-guide/.

The companion wave, and the posture

The release did not land alone. An Agent Control Standard was donated to OWASP alongside the list, and the GenAI Red Teaming Manual and the LLM Exploit Generation Guide 2.0 followed in October. OWASP also reported that the 2026 edition “surpassed 10,000 downloads within its first 48 hours”, alongside a community it put at more than 30,000 members. The numbers are OWASP’s own. The direction matters more: the field is consolidating on one taxonomy, and Appendix A exists so the list can live inside an audit argument rather than beside one.

Keep the posture line. Assume the model will be fooled, and build the system around it so that nothing important breaks. With incident data behind the 2026 list for the first time, the rankings give that engineering posture something it never had before: a reviewed map of where to spend the effort.