The OWASP LLM Top 10 2026: What Changed, and Why It Matters

A new list, and a different way of building it

OWASP published the GenAI LLM Top 10 2026 on 4 August 2026, replacing the 2025 edition. Eight of the ten positions changed, one entry was renamed, and the methodology changed in a way that matters more than any single move on the list.

Previous editions were ranked by practitioner vote. This one is a hybrid: the community vote carried 75% of the weight, and the remaining 25% came from 6,639 real incidents drawn from public vulnerability databases and an AI-harm database. That is the first time observed harm, rather than expert opinion alone, has shaped the ordering — and it is why some entries moved against what voters expected.

The 2026 list

|---|---|---|

The thesis behind it

The framing OWASP put at the centre of this edition is the most quotable thing in it, and the most useful:

> Stop trying to build a model that cannot be fooled. Build the system around it.

That is a real change in posture. Earlier guidance implicitly treated prompt injection as a problem to be solved at the model boundary — better filters, better system prompts, better guardrails. Three years of evidence say that boundary is porous and will stay porous. So the engineering objective shifts from *prevention* to containment: assume the model will be manipulated, and design so that a manipulated model cannot do much damage.

Everything else in the 2026 reordering follows from that assumption.

Why Excessive Agency jumped to third

This is the headline move, and it is the one to act on. Excessive Agency is what happens when a model has more capability than the task requires: tools it does not need, permissions broader than its purpose, or the ability to act without a human in the loop.

It rose because deployments changed. In 2024 most LLM applications generated text. By 2026 a large share execute multi-step workflows, call tools, query internal systems and take actions with real consequences. That converts prompt injection from an embarrassing-output problem into a privilege-escalation problem: the injection is the entry, and the agency is the payload.

The practical controls are unglamorous and mostly familiar from ordinary application security:

Why Unbounded Consumption rose four places

This one surprised people, and the incident data is the reason. Unbounded Consumption covers resource exhaustion: uncapped token spend, runaway agent loops, denial of wallet. It is not glamorous and it does not make headlines, but it happens constantly, and in a metered-inference world it converts directly into money.

Rate limits per user, hard caps on agent iteration depth, token budgets per session, and alerting on cost anomalies. If you run agents in production without an iteration ceiling, this is your most likely incident, not your least.

Why Misinformation climbed despite scepticism

Voters ranked Misinformation low; the incident data pushed it up two places anyway. The disagreement is instructive. Practitioners tend to see a wrong answer as a quality problem rather than a security one. The incident record shows wrong answers causing system-level failures — bad output consumed by a downstream automated process, acted on without review, at scale.

The control is architectural rather than model-level: do not let unverified model output drive consequential automated decisions without a check, and make the provenance of an answer visible to whoever consumes it.

The rename: System Prompt Leakage became Hidden Context Exposure

More than cosmetic. System Prompt Leakage described a narrow failure — the model reveals its instructions. Hidden Context Exposure describes the general case: anything in the model's context that the user was not meant to see can escape, and in a retrieval-augmented or agentic system that context contains far more than a system prompt. Retrieved documents, other users' data, tool outputs, internal identifiers, conversation history from a different session.

The rename tells you where to look. Do not audit your system prompt; audit everything that reaches the context window and ask who is entitled to see each piece of it.

Improper Output Handling fell five places, and that is not good news

It dropped from fifth to tenth. Read that carefully: a fall in a risk ranking usually means the risk is better managed, and here it partly does — output encoding and sanitisation are now reasonably standard practice in mature LLM applications. But a lower rank is not an argument for less attention if your own application has not done that work. The list ranks the field, not your codebase.

What to do this quarter

If you own an LLM application, in this order:

1. Inventory your agents' capabilities. Not their prompts — their tools, credentials and permissions. Cut anything not required by the task. This addresses the biggest mover on the list.

2. Put a ceiling on everything. Iteration depth, tokens per session, spend per user, tool calls per request.

3. Audit the context window, not the prompt. Enumerate every source that can reach it and the entitlement rules for each.

4. Find the automated decisions downstream of model output and insert a check where the consequence is material.

5. Log tool invocations and alert on anomalies. You cannot investigate what you did not record.

Where this sits relative to other frameworks

The OWASP list tells you what goes wrong. MITRE ATLAS tells you how adversaries make it go wrong, with documented case studies, and the two are complementary rather than competing — ATLAS techniques map onto OWASP categories reasonably cleanly. If you are governing AI systems rather than building them, the NIST AI Risk Management Framework is the vocabulary your auditors and regulators will use, and the EU AI Act is the one with penalties attached.

Interviewers in this space increasingly expect you to know which framework answers which question. Reaching for OWASP when asked a governance question, or NIST when asked a technical one, reads as unfamiliarity with both.

Practise the material

CyberCertPrep covers AI and LLM security across its practice bank and hands-on labs, including prompt injection and agentic risks, the OWASP LLM categories, model supply-chain concerns, and the governance frameworks regulators actually reference. Every question carries a written explanation of why the right answer is right — which matters more than usual in a domain where the guidance itself is still moving, as an eight-position reshuffle in a single year makes clear.