Contents
- Introduction
- Real-world incident data influences the ranking for the first time
- How the ranking changes between 2025 and 2026
- Prompt Injection significantly broadens its scope
- Sensitive Information Disclosure covers many more exposure surfaces
- Excessive Agency becomes one of the main risks
- Supply Chain drops one position but gains depth
- Data and Model Poisoning introduces new scenarios
- Unbounded Consumption moves up four places
- Misinformation rises and gains importance in evaluation
- System Prompt Leakage becomes Hidden Context Exposure
- Vector and Embedding Weaknesses becomes more technical
- Improper Output Handling drops to tenth place but broadens its scope
- A clearer boundary with agentic applications
- What this really changes for security assessments
- References
Introduction
OWASP has recently published the 2026 edition of its Top 10 for LLM Applications [1], a reference guide that identifies the main security risks associated with developing and deploying applications based on large language models and provides guidance on how to prevent or mitigate them. The new edition retains many of the categories already present in 2025, but changes their relative ranking, significantly expands some of them, and redefines others to account for scenarios that have become more relevant.
This increased level of detail is also reflected in the length of the guide itself. The 2026 edition runs to 122 pages, compared with 45 pages in the 2025 edition [2]. This increase reflects a much more detailed treatment of the risks, attack scenarios, and mitigation measures, as well as the inclusion of additional analysis and references. The comparison is therefore particularly interesting because the changes are not limited to adding or removing risks. In several categories that remain in the list, OWASP has expanded the scope of the threat, added new attack scenarios, or developed the mitigation guidance in greater depth.
The 2026 edition also introduces an element that helps explain many of these changes: for the first time, professional judgment is systematically complemented by data from real-world incidents.
Real-world incident data influences the ranking for the first time
Until now, the OWASP Top 10 had been built primarily around the judgment of the professional community. In 2026, that judgment still carries the greatest weight, but it is complemented by data from real-world incidents.
For this edition, OWASP analyzed a corpus of 7,714 incidents from public vulnerability databases and an AI-related harm database. Of these, 6,639 contained sufficient information to be classified. Professional voting accounts for 75% of the final weighting, while incident data contributes the remaining 25%.
The comparison between the two sources produced some significant differences. Prompt Injection, for example, would have fallen outside the top ten if the ranking had been based solely on the incident data. OWASP attributes this in part to the level of defensive maturity that already exists around this threat. It remains number one because the risk persists wherever the model processes untrusted information.
Misinformation provides the opposite example. Professionals initially ranked it relatively low, while the incidents analyzed by OWASP showed considerably greater relevance. The category consequently rises to seventh place.
This new methodological component helps explain why some risks have moved up or down in the 2026 ranking.
How the ranking changes between 2025 and 2026
A direct comparison of both editions shows several significant changes:
Source: OWASP Top 10 for LLM Applications [1]
The most notable changes are the rise of Excessive Agency, from sixth to third place, and Unbounded Consumption, which moves up four positions. Conversely, Improper Output Handling falls from fifth to tenth place. Prompt Injection and Sensitive Information Disclosure retain the top two positions.
System Prompt Leakage is also renamed Hidden Context Exposure. This is more than a terminology change, as the new category significantly broadens the concept of internal information that may be exposed.
Prompt Injection significantly broadens its scope
Prompt Injection remains the number one risk, but its definition in 2026 is considerably broader.
The previous edition already covered direct and indirect injections and various scenarios involving external content. In 2026, OWASP explicitly includes user input, RAG-retrieved content, tool outputs, images, audio, video, persistent memory, and even certain forms of intermediate reasoning as potential attack surfaces.
The guide proposes analyzing these threats across three dimensions: how the content reaches the model, how it can propagate, and how the malicious instruction is encoded. This makes it possible to distinguish, for example, between an injection that only affects a single conversation and one that manages to introduce malicious instructions into memory or a RAG corpus that will be used by later sessions. It also allows for attacks that do not depend on visible text, such as instructions hidden through Unicode characters, images, or steganographic techniques.
This broader scope is particularly relevant to applications that use agents. A malicious instruction that alters the model’s behavior may ultimately trigger calls to file systems, email, cloud APIs, MCP servers, or sub-agents, provided the model has access to them.
The mitigation guidance reflects this change in perspective. OWASP states that there is currently no mechanism capable of reliably preventing all prompt injection attacks. The recommended approach is therefore to design applications on the assumption that the instructions received by the model may be manipulated and to implement independent controls that restrict what the model can do and which resources it can access.
The practical implication is important: the goal should not be to make the model incapable of interpreting a malicious instruction under every possible circumstance, something OWASP considers impossible to guarantee with current models. The architecture should instead prevent model manipulation from automatically becoming access to private information, command execution, or destructive actions.
Sensitive Information Disclosure covers many more exposure surfaces
Sensitive Information Disclosure remains in second place, but its scope increases significantly.
In 2026, OWASP identifies model responses, tool-call arguments, reasoning traces, RAG-retrieved content, multimodal outputs, logs, telemetry, embeddings, and certain observable characteristics during inference, such as token length, latency, or cache behavior, as potential channels for information exposure.
This changes how information leakage needs to be understood. A system may not directly display a confidential document to the user and yet still expose sensitive information by placing fragments of that document in a trace, in tool arguments, or through another observable channel. The guide also warns that embeddings used as backups should not automatically be considered harmless, since certain techniques may allow information from the original documents to be reconstructed.
The 2026 edition also organizes the problem across four lifecycle stages: training, inference, pipeline, and observation. This covers everything from data memorization during training to information that may be indirectly exposed through observable properties of the system during inference.
For an assessment, this considerably expands the scope that needs to be reviewed. It is no longer enough to test what a chatbot can reveal in response to particular questions. An assessment should also examine what data enters the context, what information the system can retrieve, what ultimately becomes part of models or embeddings, and what is recorded by the various observability systems.
Excessive Agency becomes one of the main risks
The move of Excessive Agency from sixth to third place is one of the most significant changes in the edition.
In 2025, OWASP already associated this risk with three main problems: excessive functionality, excessive permissions, and excessive autonomy. The guide recommended reducing available functionality, applying least privilege, using the user’s identity and permissions where possible, and requiring approval for high-impact actions.
In 2026, these recommendations become even more relevant in the context of agentic applications. The guide emphasizes keeping authorization controls outside the model and preventing a decision made by the LLM from being sufficient on its own to execute a privileged operation.
This becomes particularly important when multiple tools can be chained together. An agent may have permission to query one system, modify another, and communicate with a third party. Although each individual permission may appear reasonable, their combination can create capabilities far beyond what was originally intended. For this reason, the 2026 edition emphasizes limiting available capabilities and keeping authorization decisions in deterministic components that do not depend on the model correctly interpreting its own restrictions.
This category is also closely related to Prompt Injection. An injection may cause the model to behave in an unintended way, but the permissions, tools, and degree of autonomy available to the system determine how far that behavior can actually go.
Supply Chain drops one position but gains depth
Supply Chain moves from third to fourth place, although the category is significantly expanded.
The 2025 edition already covered risks related to third-party components, vulnerable models, outdated models, datasets, and techniques such as LoRA and PEFT.
In 2026, OWASP expands the supply chain analysis to models, datasets, adapters, and other artifacts. The guide places particular emphasis on the possibility that a seemingly legitimate component may have been modified or replaced and recommends being able to verify its provenance and integrity before incorporating it into a system. It therefore introduces references to inventories such as SBOM, AIBOM, and ML SBOM, as well as artifact-signing mechanisms.
The guide also covers scenarios involving manipulated models, insecure deserialization, compromised adapters, and malicious components distributed through public repositories.
Data and Model Poisoning introduces new scenarios
Data and Model Poisoning moves from fourth to fifth place.
One of the changes explicitly highlighted by OWASP is the inclusion of subversion during fine-tuning, alongside broader coverage of datasets, models, embeddings, RAG, and other artifacts.
The practical difference is that the attack point does not necessarily have to be the original dataset. It can also be found in later stages where that material is used to adapt or update a model. The 2026 guide therefore places greater emphasis on being able to trace the origin of each dataset and model and on detecting behavioral changes after training or alignment processes.
Unbounded Consumption moves up four places
One of the most striking changes is the move of Unbounded Consumption from tenth to sixth place.
The category had already expanded in 2025 beyond the traditional concept of denial of service to include uncontrolled resource consumption and unexpected costs. In 2026, the treatment becomes broader and also connects consumption with certain model-extraction scenarios and the characteristics of agentic systems.
In a traditional application, a costly request may consume excessive tokens or system resources. In an application with agents and tools, the problem can multiply: a single input may trigger a chain of calls, and a tool may cause further executions repeatedly. OWASP explicitly considers scenarios involving recursive or infinite calls and chains of operations that drive up resource consumption.
The guide therefore recommends establishing explicit consumption limits and mechanisms that stop execution when anomalous patterns are detected. The issue is not limited to the financial cost of a request. In certain architectures, controlling how much an agent can execute before it is stopped becomes part of the system’s security boundary.
Misinformation rises and gains importance in evaluation
Misinformation moves from ninth to seventh place. Its rise is related to the discrepancy OWASP identified between professional perception and the incidents it analyzed.
The 2026 edition provides more detailed guidance on determining whether a response is supported by the information available to the system. Groundedness signals, for example, are intended to assess how well a response is supported by retrieved sources, which is particularly relevant to RAG applications. Consistency checks can identify responses that contradict the available context or other parts of the information.
The guide also recommends maintaining the relationship between generated claims and the evidence supporting them. This makes it easier to investigate why a system produced an incorrect response and determine whether the problem originated in information retrieval, response generation, or another stage of the workflow.
OWASP also considers situations in which an incorrect response produced by one component can propagate through a multi-agent workflow and ultimately trigger an incorrect action.
System Prompt Leakage becomes Hidden Context Exposure
The change in name between the two editions reflects a genuine expansion of the concept.
In 2025, System Prompt Leakage focused on exposing the system prompt and on the assumption that certain internal instructions could remain private. The 2026 edition uses the term Hidden Context Exposure to cover other parts of the application’s internal context as well.
The new category includes, among other things, authorization rules, user or developer instructions, retrieved information, and details about available tools. Exposing these elements can reveal how an application is built and make subsequent attacks easier.
This also changes how mitigation should be approached. If an application needs to keep a token, credential, or authorization decision secret for its security to work, that information should not depend on the model correctly hiding a particular piece of context. OWASP recommends keeping credentials and authorization controls outside the model.
Vector and Embedding Weaknesses becomes more technical
The category moves from eighth to ninth place, but the 2026 guide goes considerably deeper into the risks associated with vector systems.
In addition to the risks already associated with RAG and embeddings, OWASP addresses issues such as embedding inversion, membership inference, poisoning during retrieval, and cross-user or cross-tenant data leakage.
One particularly relevant point is authorization before retrieval. A similarity search does not, by itself, take document access permissions into account. Therefore, if the system retrieves a confidential fragment first and only afterwards checks whether the user was authorized to access it, the content has already entered the model’s context. The authorization check has come too late.
Improper Output Handling drops to tenth place but broadens its scope
Improper Output Handling moves from fifth place in 2025 to tenth in 2026. However, its lower ranking does not mean that the scope of the category has been reduced.
The new edition explicitly incorporates code generated by assistants and considers scenarios in which model output reaches components capable of interpreting it without adequate validation, such as shell, exec, eval, SQL, or file systems. The problem arises when an output that was originally just text is subsequently treated by another component as executable code, a query, or an instruction.
OWASP explicitly states that the risk associated with insecure code generated by assistants is incorporated into this category.
Its position in the ranking should therefore not be interpreted as a reason to reduce controls over model outputs. The critical question remains what happens after the model generates its response and which components are capable of interpreting that output as code, a query, or an instruction.
A clearer boundary with agentic applications
The 2026 edition also establishes a clearer boundary between the scope of this Top 10 and the OWASP Top 10 for Agentic Applications 2026 [3].
The guide states that its primary scope is the model used as a component within an application. When the model starts acting as an actor with tools, persistent memory, and the ability to trigger subsequent consequences, OWASP recommends complementing this analysis with the dedicated Top 10 for agentic applications.
This distinction is particularly useful because several of the 2026 risks sit precisely at this boundary. Prompt Injection, Excessive Agency, memory, tools, access control, and error propagation are increasingly interconnected. The guide expands existing categories to address these scenarios while also pointing to the dedicated agentic framework when a system reaches that level of autonomy.
What this really changes for security assessments
The evolution from 2025 to 2026 points to a clear expansion of the attack surface that should be reviewed during a security assessment.
An assessment should no longer be limited to determining whether a model can be manipulated through specific prompts. The 2026 guide calls for analysis of how instructions and data are separated, what information can enter the context, who can access retrieved content, what permissions tools have, which identity is used to execute actions, what happens to data used to train or adapt models, and what information may be exposed through logs, embeddings, or other channels.
The underlying shift is that OWASP advocates a security strategy that relies less on the model always behaving as expected. The application should be designed to limit the consequences when the model is manipulated or produces an incorrect response.
For organizations that already used the 2025 edition as a reference, the update does not mean replacing the previous threat model entirely. Many categories remain. What changes is their depth, the scope of the scenarios covered, and, above all, the importance given to agentic systems, memory, tools, AI artifacts, and evidence from real-world incidents.
At Kaptor Security, we help organizations translate these principles into their real-world environments through comprehensive security assessments of AI applications, aligned with OWASP and other industry-standard frameworks. The goal is to assess the security of the entire system rather than focusing solely on the direct interaction with the model.
References
- OWASP. OWASP Top 10 for LLM Applications 2026. Available at: https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/
- OWASP. OWASP Top 10 for LLM Applications 2025. Available at: https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/
- OWASP. OWASP Top 10 for Agentic Applications 2026. Available at: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/