Source directory OWASP Foundation 2026
OWASP Top 10 for LLM Applications 2026
“OWASP Top 10 for LLM Applications 2026”. Publisher: OWASP Foundation. Version used: 2026. The Versatile AI Risk Assessment threat catalogue backs 44 of its 52 threats with this document, at 10 verified locations.
Document details
- Publisher
- OWASP Foundation
- Version used
- 2026
- Licence
- CC BY-SA 4.0
- Framework
- OWASP LLM Top 10
Open the original document at the publisher External link; the publisher’s version always takes precedence.
References in the catalogue (10)
Every row states the clause, its title, the exact location in the document and the threats that refer to it.
| Clause | Title and location | Referencing threats |
|---|---|---|
LLM01:2026 |
Prompt Injection LLM01:2026 Prompt Injection, OWASP Top 10 for LLM Applications 2026 v1.0, pp. 10-17 (doi:10.5281/zenodo.22109015); canonical text 2026/final/LLM01_PromptInjection.md at commit 7e144e05 | Prompt Injection – DirectPrompt Injection – IndirectJailbreaksMeta Prompt ExtractionHate Speech and DiscriminationSexual ContentViolence / Unsafe ActionsIllegal ActivitiesSelf-harmMalicious SoftwareAgentic AI / Autonomous AgentsRAG-Specific Attacks (Document Poisoning)Multimodal AttacksMCP Hijacking (Model Context Protocol)Agent Memory Poisoning (Persistent Context) |
LLM02:2026 |
Sensitive Information Disclosure LLM02:2026 Sensitive Information Disclosure, OWASP Top 10 for LLM Applications 2026 v1.0, pp. 18-22 (doi:10.5281/zenodo.22109015); canonical text 2026/final/LLM02_SensitiveInformationDisclosure.md at commit 7e144e05 | Meta Prompt ExtractionPrivacy AttacksSensitive Information DisclosureExfiltration from ML ApplicationModel ReconnaissanceCross-Tenant Leakage (Multi-Tenant Vector DB)Side-Channel Attacks (Timing Analysis)Shadow AI (Unsanctioned AI Service Use) |
LLM03:2026 |
Excessive Agency LLM03:2026 Excessive Agency, OWASP Top 10 for LLM Applications 2026 v1.0, pp. 23-26 (doi:10.5281/zenodo.22109015); canonical text 2026/final/LLM03_ExcessiveAgency.md at commit 7e144e05 | Insecure Tool DesignExcessive AgencyMisalignmentAgentic AI / Autonomous AgentsMCP Hijacking (Model Context Protocol) |
LLM04:2026 |
Supply Chain LLM04:2026 Supply Chain, OWASP Top 10 for LLM Applications 2026 v1.0, pp. 27-32 (doi:10.5281/zenodo.22109015); canonical text 2026/final/LLM04_SupplyChain.md at commit 7e144e05 | Supply Chain – InfrastructureSupply Chain – ModelsSupply Chain – DatasetsBackdoor ML ModelFactual Inconsistencies (Hallucinations)Middleware Exploits (AI Framework Attacks)Shadow AI (Unsanctioned AI Service Use) |
LLM05:2026 |
Data and Model Poisoning LLM05:2026 Data and Model Poisoning, OWASP Top 10 for LLM Applications 2026 v1.0, pp. 33-37 (doi:10.5281/zenodo.22109015); canonical text 2026/final/LLM05_DataModelPoisoning.md at commit 7e144e05 | Supply Chain – ModelsSupply Chain – DatasetsTraining Data PoisoningTargeted Poisoning / Label PoisoningBackdoor ML ModelSleepy Agent (Time/Event-Triggered Hidden Instructions)RAG-Specific Attacks (Document Poisoning)Graph-RAG Poisoning (Knowledge Graph Injection)Agent Memory Poisoning (Persistent Context) |
LLM06:2026 |
Unbounded Consumption LLM06:2026 Unbounded Consumption, OWASP Top 10 for LLM Applications 2026 v1.0, pp. 38-42 (doi:10.5281/zenodo.22109015); canonical text 2026/final/LLM06_UnboundedConsumption.md at commit 7e144e05 | Training Data PoisoningModel TheftModel Denial of ServiceCost Harvesting / RepurposingAgentic AI / Autonomous AgentsModel ReconnaissanceMCP Hijacking (Model Context Protocol) |
LLM07:2026 |
Misinformation LLM07:2026 Misinformation, OWASP Top 10 for LLM Applications 2026 v1.0, pp. 43-45 (doi:10.5281/zenodo.22109015); canonical text 2026/final/LLM07_Misinformation.md at commit 7e144e05 | Adversarial InputsOverrelianceControversial TopicsDisinformationFactual Inconsistencies (Hallucinations)MisalignmentModel Drift & Degradation |
LLM08:2026 |
Hidden Context Exposure LLM08:2026 Hidden Context Exposure, OWASP Top 10 for LLM Applications 2026 v1.0, pp. 46-49 (doi:10.5281/zenodo.22109015); canonical text 2026/final/LLM08_HiddenContextExposure.md at commit 7e144e05 | Meta Prompt ExtractionInsecure Output Handling |
LLM09:2026 |
Vector and Embedding Weaknesses LLM09:2026 Vector and Embedding Weaknesses, OWASP Top 10 for LLM Applications 2026 v1.0, pp. 50-54 (doi:10.5281/zenodo.22109015); canonical text 2026/final/LLM09_VectorAndEmbeddingWeaknesses.md at commit 7e144e05 | RAG-Specific Attacks (Document Poisoning)Cross-Tenant Leakage (Multi-Tenant Vector DB) |
LLM10:2026 |
Improper Output Handling LLM10:2026 Improper Output Handling, OWASP Top 10 for LLM Applications 2026 v1.0, pp. 55-57 (doi:10.5281/zenodo.22109015); canonical text 2026/final/LLM10_ImproperOutputHandling.md at commit 7e144e05 | Insecure Output HandlingInsecure Tool Design |
This page does not reproduce the text of the standards. It states the identifier, title and location of the clause; the wording itself is in the original document. The mappings are taxonomic and not evidence of compliance.
Threats referencing this document (44)
Grouped by topic. Every entry leads to the full threat page.
Agentic and Autonomous AI
Application and Integration Security
Attacks on the Running Model and Service
Harmful Content
Malicious Use for Attacks, Fraud and Disinformation
Model and Training Data Manipulation
Privacy and Data Leakage
Prompt Attacks and Guardrail Evasion
Reliability and Responsible Use
Supply Chain and Provenance
More documents from the same publisher
All documents by OWASP Foundation cited in the catalogue.
From the reference to the assessment
The full catalogue states the mitigations, the possible impact and every verified location for each threat. The live demo runs locally in your browser, with no sign-up.
Cite this page
For reports, policies or internal documents; the link leads directly to this source page.
“OWASP Top 10 for LLM Applications 2026” (OWASP Foundation). References in the AI threat catalogue, Versatile AI Risk Assessment, as of October 2026. https://www.versatile-ai-risk-assessment.com/en/wissensbasis/sources/owasp-top-10-llm-2026/