OWASP · AI Security

What Changed in the 2026 OWASP LLM Top 10?

The security community updated its list of the biggest risks in AI applications. Here is a plain-language guide to what moved, what was renamed, and the important new line between AI as a component and AI as an actor.

The big idea: two lists, meant to be paired.

  • LLM Top 10: risks when AI is part of an app.
  • Agentic Top 10: risks when AI can act — with tools, memory across sessions, and real consequences.

The four things that changed

RenamedSystem Prompt Leakage → Hidden Context Exposure

The old #7 gets a clearer name. It is not just the system prompt that can leak — hidden tool rules, developer notes, and retrieved policies are all “hidden context” the app quietly relies on. Now #8, and framed around never treating secrecy as security.

More prominentExcessive Agency, Unbounded Consumption, and Misinformation move up

As AI apps gain tools and autonomy, three risks climbed the list: Excessive Agency (#6 → #3), Unbounded Consumption (#10 → #6), and Misinformation (#9 → #7). These are the risks that bite hardest once an AI can act, not just answer.

Broader scopeOld risks grew to match how AI is really used

Prompt Injection now covers what an AI reads, hears, sees, or remembers — not just typed text. Data & Model Poisoning absorbs fine-tuning subversion. Supply Chain, Improper Output Handling, and Vector & Embedding Weaknesses all widened too.

Boundary clarifiedLLM component vs. agentic actor

The 2026 document draws a clearer line. The LLM Top 10 covers risks when the model is a component inside an application. Once the model becomes an actor — with tools, memory across sessions, and downstream consequences — the risk moves to the OWASP Agentic Top 10. The two lists are meant to be paired, because neither covers that ground alone.

2025 → 2026, side by side

2025

  1. Prompt Injection
  2. Sensitive Information Disclosure
  3. Supply Chain Vulnerabilities
  4. Data and Model Poisoning
  5. Improper Output Handling
  6. Excessive Agency
  7. System Prompt Leakage
  8. Vector and Embedding Weaknesses
  9. Misinformation
  10. Unbounded Consumption

2026

  1. Prompt Injection
  2. Sensitive Information Disclosure
  3. Excessive Agency (up from #6)
  4. Supply Chain (was #3)
  5. Data and Model Poisoning (now absorbs fine-tuning subversion)
  6. Unbounded Consumption (up from #10)
  7. Misinformation (up from #9)
  8. Hidden Context Exposure (renamed from System Prompt Leakage)
  9. Vector and Embedding Weaknesses (was #8)
  10. Improper Output Handling (was #5)

About this page & license

Robot Explains is an independent educational adaptation and is not official OWASP guidance. It is based on the OWASP Top 10 for LLM Applications by the OWASP GenAI Security Project.

The OWASP material is licensed under Creative Commons Attribution-ShareAlike 4.0 (CC BY-SA 4.0), and this adaptation is shared under the same license.

See the 2026 poster set → View the 2025 archive