OWASP LLM Top 10 2026: What Actually Changed

Some of the most important updates that deserve your attention include AI agents moving into the top 3, unbounded consumption of resources rising dramatically, and OWASP stating plainly that prompt injections can’t be prevented and systems must be architected around assuming that the model will be fooled. Below you'll find a side-by-side comparison of the OWASP LLM Top 10 2026 vs 2025

The new version of the list is now backed by data from 7,714 real incidents in public vulnerability databases, 6,639 of which were detailed enough to classify. Community vote still matters most, but 25% of the weight is now being put on incident data. The document also roughly tripled in size, from 46 pages to 122.

OWASP LLM Top 10: 2026 vs. 2025

Prompt injection - prevention is no longer enough

Prompt injection means forcing AI to follow malicious instructions, altering the model’s behaviour. This can be done directly through user input, but also by uploading a malicious file, or by getting the model to retrieve malicious content from the web or from any other attacker-controlled location.

There is no reliable prevention as of today, and the new OWASP list suggests that systems surrounding the AI model should be designed with the assumption that the model will eventually be fooled, and when it happens, impact is restricted by what the model can actually do and what its outputs are permitted to reach. This does not mean, however, that sanitization and prevention should be removed, they just move lower on the priority list.

When it comes to prompt injection being exploited in production environments, it’s getting increasingly rare. Going by incident counts alone, prompt injection drops out of the TOP 10 list altogether. This is mostly because teams focus heavily on prevention, committing substantial resources. OWASP calls this a defense effect. It was kept in the top spot by expert opinion.

AI agents are now a top three risk

Excessive agency is when an agent can do more than its job actually needs - too many tools, too much access, or no one checking before it acts. Organizations are moving from simple chatbots that respond with text to more complex agentic LLMs that actually interact with tools. Excessive agency’s rise reflects this, and expert opinion and the incident record agree - this is where damage is landing.

This can be illustrated with an example of an email-summarizing tool. Such a tool only needs functionality to read email, with permissions passed from the requesting user. If such a tool also has permission to send emails by itself, that’s excessive agency. If such a tool were vulnerable to prompt injection, an attacker could:

• send an email - excessive functionality
• send an email as any user if the tool doesn’t execute in the user’s context
• send an email without the user confirming the send operation - not keeping the user in the loop

OWASP’s mitigations did not change much from 2025, since the root problems remain the same - excessive functionality, excessive permissions and excessive autonomy. OWASP recommends limiting the tools LLM agents have access to, but also minimizing the functionality that tools provide. Limit tool permissions and execute tools in the context of the user, not the agent. Avoid open-ended tools (e.g. running arbitrary code or a shell command, fetching a URL, etc.) altogether. Keeping a human in the loop is recommended to approve high-impact actions.

AI misuse can turn into a real bill

Another big mover is Unbounded Consumption, which climbed from #10 to #6, the biggest climb of any category on the list. Unbounded consumption enables attackers to inflict unsustainable financial costs, with little cost of their own. This is further compounded by growing adoption of reasoning and thinking models, multimodal models that substantially increase per-request compute costs, and agentic architectures that can fan out a single request into multiple downstream operations.

Traditional request limiting doesn’t work alone here. The problem does not lie in request size or count. It’s necessary to implement token-aware cost controls, together with hard spending caps and agent-level circuit breakers that limit recursion depth and loops.

Models are getting misinformed by models

Misinformation is no longer limited to humans. In agentic systems, model outputs drive tools, generate code and coordinate across multiple agents. Recommended mitigations were expanded accordingly. Ground Claims Before Action means outputs must be grounded in authoritative and current sources before being acted on. Implement Claim-Check-Act Pattern means generation and execution must be separated, and claims must be verified before acting.

Output Handling Falls to the Bottom, Sensitive Information Stays at #2

Two more entries are worth a mention. Sensitive Information Disclosure held its #2 spot, and OWASP calls it the entry where confidence is highest, the one place near the top where the vote and the incident data fully agree. Severity there is now judged by what a recipient can actually learn, not by whether the disclosed text reads like ordinary language. Improper Output Handling fell the furthest of any category, from #5 to #10, the single biggest drop on the list.

What can you do right now: OWASP LLM Top 10 checklist

You don't need to wait for a full assessment to start closing the biggest gaps. This OWASP LLM Top 10 checklist covers the changes that matter most in the 2026 list:

Assume prompt injection will succeed. Map every place your model can be reached by untrusted content (user inputs, uploaded files, web pages, RAG documents, e-mails) and decide what the worst outcome would be if that input contained malicious instructions.

• Check tools and permissions of your agents. For each tool, ask: does the agent really need it, and does the tool do more than the job requires? Remove anything that is not required.
• Make sure tools are run in the user's context, not the agent's. The agent should never be able to do more than the person who is asking it.
• Put a human in the loop for high-impact actions - sending, deleting, paying, deploying code or changing permissions should require human confirmation.
• Avoid open-ended tools. Arbitrary code execution and unrestricted URL fetching are short path from a fooled model to a critical vulnerability.
• Set token-aware cost controls and hard spending caps. Add circuit breakers that limit recursion depth, loops and fan-out in agentic workflows.
• Review what the model can disclose. Judge sensitive information risk by what a recipient could learn, including from system prompts and hidden context, not by how the text looks.
• Treat model outputs as untrusted input. Sanitize anything the model returns before it reaches a browser, a database, a shell or another system.
• Test it the way an attacker would. Have your AI assistant or agent go through penetration testing aligned with the OWASP LLM Top 10 2026.

Source: https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/ 

Do you want your AI tested according to the latest OWASP TOP 10 methodology?

The World of AI and LLMs is moving fast. If your organization is deploying AI assistants or agents, it is worth testing them the way you would test any system with real permissions, through penetration testing and red teaming. Citadelo tests the security of AI and LLM applications and we always follow the latest threats and risks.