OWASP Top 10 for LLM applications (2026 edition) and agentic AI risks

What it is

OWASP’s GenAI Security Project maintains a Top 10 list of risks for applications that use large language models (LLMs): chatbots, retrieval-augmented generation (RAG) search, coding assistants and autonomous agents. The first list appeared in 2023, a substantially revised 2025 edition followed in November 2024, and the 2026 edition was released in August 2026. Since December 2025 there is also a separate Top 10 for Agentic Applications, focused on systems where models plan and act using tools.

Why it matters

LLMs blur the boundary between data and instructions. Any text the model reads, whether a user message, a web page, an email or a retrieved document, can contain instructions that change its behaviour. Traditional input validation does not solve this. As models are connected to tools, databases and APIs, a successful injection can turn into real actions, so the impact grows with the permissions you give the system.

Key ideas and what changed

• Assume injection will sometimes succeed. The 2026 edition explicitly shifts from trying to make the model unfoolable towards limiting the blast radius by hardening the surrounding application.
• Excessive Agency means giving the model more functions, permissions or autonomy than the task needs. Its rise to third reflects the spread of agents.
• Hidden Context Exposure broadens the old System Prompt Leakage entry to any non-user-facing content in the context: system prompts, tool schemas, retrieved policy text and workflow rules. Assume all of it can be discovered and never place secrets there.
• Unbounded Consumption covers runaway cost and denial of service, including attacks that drain inference budgets.
• Methodology. According to coverage of the release, the ranking blends practitioner consensus with a large set of real-world incident reports, which pushed Misinformation and Unbounded Consumption higher.
• Agentic Top 10. The December 2025 list covers risks such as goal hijacking, tool misuse, identity and privilege abuse, and cascading failures across multiple agents.

How practitioners apply it

1. Threat model the whole pipeline: data sources, retrieval store, model, tools and output consumers.
2. Least privilege for tools. Give each agent its own scoped identity and credentials. Read-only by default, and human approval for payments, deletions, outbound email or code execution.
3. Treat model output as untrusted input to the next system. Encode it before rendering in HTML and never pass it straight to a shell or SQL query.
4. Separate and label untrusted content in prompts, and filter retrieved documents by the user’s own access rights.
5. Set quotas and monitor cost, tokens and tool-call rates per user and per agent.
6. Log prompts, tool calls and decisions so incidents can be investigated.

A realistic scenario: an email assistant can read a user’s inbox and send messages. An attacker emails the user a message containing hidden text telling the assistant to forward the latest invoices to an outside address. If the assistant has unrestricted send rights, the injection becomes data theft. If sending to new external recipients requires the user to confirm, the same injection produces only a suspicious prompt that the user can reject. The model was fooled in both cases; the design decided the outcome.

Governance frameworks such as the NIST AI RMF provide the organisational side; the OWASP lists are the engineering checklist.

Limitations and open questions

• No complete fix for prompt injection exists. Defences reduce likelihood and impact but cannot guarantee safety.
• Fast change. The list has changed three times in three years; architectures change faster still.
• Testing is immature. Red teaming LLM systems is labour-intensive and results vary between model versions.
• Identity for agents. How to give each agent a distinct, auditable identity with short-lived, narrowly scoped credentials is still being worked out across vendors and standards bodies.
• Overlap with classic risks. Many incidents are ordinary access control or output encoding bugs in new clothes, so the web Top 10 still applies.