---
title: "Glossary: OWASP Top 10 for LLM Applications"
canonical_url: "https://tokenobserve.com/glossary/owasp-llm-top-10"
published: 2026-09-02
last_updated: 2026-10-21
---

# Glossary: OWASP Top 10 for LLM Applications

The OWASP Top 10 for Large Language Model Applications is a community-maintained list of the ten most significant security risks in applications built on large language models, published by the OWASP GenAI Security Project. It is an awareness and prioritisation document rather than a standard: nothing certifies against it, and its ranking comes mainly from a vote among contributing practitioners; the 2026 edition was the first to weigh that vote against a corpus of recorded incidents, at a quarter of the weight.

## Also called

- OWASP LLM Top 10
- OWASP Top 10 for Large Language Model Applications
- LLM01 prompt injection
- OWASP GenAI Security Project

## In practice

The list first appeared in August 2023, was revised as version 1.1 that October, was substantially rewritten for the 2025 edition released in November 2024, and was reordered again for the 2026 edition published in August 2026. The 2025 entries are LLM01 prompt injection, LLM02 sensitive information disclosure, LLM03 supply chain, LLM04 data and model poisoning, LLM05 improper output handling, LLM06 excessive agency, LLM07 system prompt leakage, LLM08 vector and embedding weaknesses, LLM09 misinformation, and LLM10 unbounded consumption. The 2026 edition keeps prompt injection and sensitive information disclosure first and second, lifts excessive agency to LLM03 and unbounded consumption to LLM06, drops improper output handling to LLM10, and renames system prompt leakage as hidden context exposure — so an identifier means nothing without its year: LLM04 is data and model poisoning in one edition and supply chain in the other.

What changed between the 2023 and 2025 editions is more informative than the list itself, because each change records something the field learned. Training data poisoning widened into data and model poisoning once fine-tuning and adapter supply chains became ordinary. Model denial of service widened into unbounded consumption, because the failure teams meet is a runaway cost and quota failure rather than an availability one. Insecure plugin design and model theft disappeared as standalone entries and were folded into supply chain, excessive agency and unbounded consumption. Overreliance became misinformation, moving the emphasis off the user’s psychology and onto the output. Three entries are new — system prompt leakage, vector and embedding weaknesses, and misinformation — and all three arrived because retrieval-augmented architecture became the default between those two editions. The 2026 reordering records a lesson too: excessive agency climbed to third because the practitioner vote and the incident record agreed that agentic deployments are where the damage is landing.

How to read it matters. It is a risk register, not a control set: each entry describes a class of failure and suggests mitigations, and none of them is a requirement you can pass or fail. Two of the ten sit outside anything a runtime control can reach — data and model poisoning happens inside a training pipeline, and vector and embedding weaknesses presuppose a retrieval layer — which is why a vendor mapping with something in all ten rows should be read sceptically rather than favourably. The list’s real value is that it is the register a security reviewer already has open, which makes it the fastest shared vocabulary for describing the shape of a control’s coverage, on the condition that the empty rows are published beside the full ones.

Three entries behave differently from their web-application analogues and are worth understanding individually. Prompt injection, LLM01 in both editions, has no complete fix: detection is heuristic, an attacker gets unlimited attempts against a fixed set of patterns, and novel phrasing and non-English payloads evade pattern scoring — so the layer that carries the weight is not the detector but what a successful injection can reach, which means deny-by-default grants, approvals bound to the exact payload, and egress controls that hold whether or not the scanner fired. Excessive agency is an authorisation problem in AI costume: the unit that matters is the action rather than the system, and an agent granted a whole API has been granted every endpoint in it. Sensitive information disclosure is a data-loss problem whose novel half is the response channel, because a model can emit an identifier nobody ever sent it, so scanning only the request misses the case that is hardest to explain afterwards.

The same project publishes siblings that are frequently confused with it. There is an agentic list, the Top 10 for Agentic Applications for 2026, whose ASI-prefixed entries run from agent goal hijack, tool misuse and identity and privilege abuse, through agentic supply chain vulnerabilities — tool-descriptor injection among them — unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures and human-agent trust exploitation, to rogue agents; and an earlier threat-and-mitigation taxonomy that adds repudiation and the overwhelmed human reviewer. There is also a governance checklist and a set of security guides. And it is a separate project from the OWASP Top 10 for web applications, with a different method: the web list is derived from contributed, CWE-tagged testing data across hundreds of thousands of applications, while the LLM list is voted on by practitioners — entirely so through 2025, and in 2026 with the vote carrying three-quarters of the weight and a corpus of public incident records the remaining quarter. That is a defensible choice for a field whose incident record is young and noisy, and it is also a real limit on how much the ordering should be taken to mean.

## Example: The two rows an accurate mapping leaves empty

A vendor’s control mapping shows something against all ten entries. Read the poisoning and vector rows first — LLM04 and LLM08 in the 2025 numbering, LLM05 and LLM09 in the 2026 one — because they are where the overclaim shows. Data and model poisoning happens inside a training pipeline, which a control sitting between an agent and a provider’s API cannot observe at all; vector and embedding weaknesses require a retrieval layer, which a product with no vector store does not have. A tick in either row is either a different risk relabelled or a claim that will not survive the first question about it. There are accurate adjacent statements for both, and they are more useful than the tick: recording which provider and model served every request means that if a model is later found to be poisoned, you can enumerate exactly which of your requests it touched; and content retrieved from a poisoned index is inspected at the moment it enters a governed request, even though the index itself is outside scope.

## Routinely confused with

OWASP Top 10 (web applications): Different project, different cadence, different identifiers (A01:2021 against LLM01:2025) and a different methodology: the web list is built from contributed vulnerability data across a very large application corpus, while the LLM list is built mainly from practitioner consensus. Addressing one says nothing about the other, and an application built on an LLM needs both.

MITRE ATLAS: ATLAS is an adversary tactics-and-techniques knowledge base for AI systems, modelled on ATT&CK: it describes how an attack proceeds, step by step, with observed case studies. The OWASP list describes which risks to prioritise when building. They are complementary: ATLAS is what you use to reason about a specific attack path, OWASP is what you use to decide what to build first.

The OWASP Agentic Top 10: The LLM list covers applications where a model produces output; the agentic list covers systems where a model takes actions, and adds the failure modes that only exist once it can: goal hijack, privilege accumulation across delegations, cascading failure between agents, and rogue agents nobody registered. An agent platform needs both lists, and the agentic one maps more densely onto runtime controls.