AI Hacking
AI Security Resources

OWASP Top 10 for LLM Applications 2026

The definitive list of critical security risks in LLM applications - reflecting the OWASP 2026 release and reviewed October 2026

73%
AI deployments have critical vulnerabilities
(OWASP State of AI Security, 2025)
41%
Enterprise AI has unauthenticated APIs
(CodeWall Research, 2025)
Virtually 100%
Prompt injection exploitable in LLM deployments
(OWASP LLM Top 10, 2025)
⚠

Critical Risk Awareness

Prompt Injection remains the #1 vulnerability. See our comprehensive Prompt Injection Guide →

🔮

OWASP LLM Top 10 2026: What's Changed

The 2026 release is the active standard. Compared with the 2025 list it reorders the top five and adds coverage for agents and retrieval systems:

  • Moved up: Sensitive Information Disclosure — Now LLM02, reflecting credential and prompt leakage as a top-tier loss path
  • Moved up: Supply Chain Vulnerabilities — Now LLM03, covering plugins, model hubs, and agent tool marketplaces
  • Renamed: Data and Model Poisoning — Absorbs the old Training Data Poisoning at LLM04, now including RAG corpora and agent memory
  • Renamed: Improper Output Handling — Formerly Insecure Output Handling, now LLM05 with clearer downstream sink guidance
  • NEW: System Prompt Leakage — LLM07, prompt extraction as a distinct risk once agents expose their context
  • NEW: Vector and Embedding Weaknesses — LLM08, retrieval poisoning and embedding store access control
  • NEW: Misinformation — LLM09, fabricated or unverifiable model output reaching users and systems
  • Broadened: Excessive Agency — LLM06, expanded to cover MCP tool abuse and delegated OAuth scopes

Read the OWASP LLM Top 10 →

LLM01

Prompt Injection

Critical

Manipulating LLM behavior through crafted inputs that override original instructions. Includes both direct (user input) and indirect (external data) injection.

Attack Types
  • Direct Injection: Malicious user prompts that override system instructions
  • Indirect Injection: Hidden instructions in external documents, web content, or API responses
  • Context Manipulation: Exploiting conversation context to alter behavior
  • Jailbreak Attacks: Bypassing safety filters through creative prompting
Attack Examples
  • Ignore previous instructions and...
  • Text embedded in invisible unicode characters
  • Prompt injection via stored XSS in web content
  • DAN (Do Anything Now) style jailbreaks
Mitigation Strategies
  • Implement strict input validation and sanitization
  • Use privilege separation between user inputs and system prompts
  • Apply output filtering before displaying results
  • Monitor for injection patterns in logs
  • Implement defense-in-depth with multiple security layers
LLM02

Sensitive Information Disclosure

Critical

LLMs inadvertently revealing private, confidential, or proprietary information through model outputs.

Attack Types
  • Training Data Extraction: Recovering sensitive data from model memory
  • PII Leakage: Exposing personally identifiable information
  • API Key/Credential Exposure: Revealing secrets in responses
  • Business Logic Disclosure: Exposing proprietary algorithms or processes
Attack Examples
  • Extracting email addresses through specific prompts
  • Revealing SQL credentials in error messages
  • Disclosing customer PII from training data
  • Exposing internal system prompts
Mitigation Strategies
  • Implement robust input/output filtering
  • Enforce data sanitization pipelines
  • Apply user opt-out policies for data usage
  • Use differential privacy techniques
  • Restrict system prompt access and visibility
LLM03

Supply Chain Vulnerabilities

High

Compromised or vulnerable components in the LLM supply chain including models, APIs, plugins, and third-party services.

Attack Types
  • Model Tampering: Compromised pre-trained models
  • PyPI/npm Dependency Vulnerabilities: Insecure libraries
  • Malicious Fine-tuning Data: Poisoned training datasets
  • Compromised API Providers: Untrusted LLM services
Attack Examples
  • Backdoored model weights from untrusted source
  • Vulnerable transformer library exploitation
  • Poisoned training data with hidden triggers
  • Compromised RAG document store
Mitigation Strategies
  • Verify model integrity through checksums and signatures
  • Maintain SBOM (Software Bill of Materials)
  • Use trusted model hubs and verify provenance
  • Scan dependencies for known vulnerabilities
  • Implement model lifecycle management
LLM04

Data and Model Poisoning

High

Introducing malicious or biased data into training pipelines, fine-tuning data, or RAG knowledge bases to compromise model integrity.

Attack Types
  • Training Data Poisoning: Corrupting model training data
  • Fine-tuning Poisoning: Injecting backdoors via fine-tuning
  • RAG Poisoning: Contaminating retrieval knowledge bases
  • Embedding Manipulation: Corrupting vector databases
Attack Examples
  • Inserting biased examples to alter model behavior
  • Creating backdoor triggers in training data
  • Poisoning public datasets used for training
  • Injecting false information into RAG documents
Mitigation Strategies
  • Verify data provenance and supply chain integrity
  • Implement data validation and anomaly detection
  • Use data sanitization pipelines
  • Apply robust fine-tuning safeguards
  • Monitor for model behavior drift
LLM05

Improper Output Handling

High

Failing to validate, sanitize, or properly handle LLM outputs before passing them to downstream systems or users.

Attack Types
  • XSS via LLM Output: Cross-site scripting from model responses
  • SQL Injection: Malicious queries generated by LLM
  • Command Injection: LLM generating unsafe system commands
  • Path Traversal: LLM revealing or accessing unauthorized paths
Attack Examples
  • LLM generating JavaScript that executes in browser
  • Model outputting malicious SQL queries
  • Code generation including unsafe system calls
  • File path disclosure in responses
Mitigation Strategies
  • Implement output validation and sanitization
  • Use context-aware content filtering
  • Apply the same security controls as user inputs
  • Sandbox LLM outputs before downstream use
  • Enable secure coding modes in code generation
LLM06

Excessive Agency

High

Granting LLM systems too much functionality, autonomy, permissions, or enabling unauthorized or harmful actions.

Attack Types
  • Unlimited Function Access: Excessive API permissions
  • Autonomous Action: Performing actions without human approval
  • Tool Abuse: Exploiting integrated external tools
  • Chain-of-Thought Manipulation: Altering reasoning processes
Attack Examples
  • LLM with admin API access performing unauthorized changes
  • Auto-executing financial transactions
  • Deleting resources without confirmation
  • Manipulating user data without consent
Mitigation Strategies
  • Implement least privilege access controls
  • Require human-in-the-loop for critical actions
  • Apply rate limiting to sensitive operations
  • Log and monitor all autonomous actions
  • Use scope limitations on tool access
LLM07

System Prompt Leakage

Medium

Exposing confidential system prompts, instructions, or internal logic through manipulation or inadequate protections.

Attack Types
  • Direct Prompt Extraction: Social engineering to reveal prompts
  • Context Overflow: Overflow techniques to expose system messages
  • Role Play Exploitation: Trick LLM into revealing instructions
  • Log Leakage: Exposing prompts in logs or errors
Attack Examples
  • Asking LLM to repeat 'previous text' to extract system prompt
  • Using context window overflow to bypass instruction parsing
  • Prompt injection to override system role
  • Finding prompts in application logs
Mitigation Strategies
  • Obfuscate system prompts where possible
  • Implement prompt isolation techniques
  • Use separate processing for sensitive instructions
  • Monitor for prompt extraction attempts
  • Apply strict log filtering
LLM08

Vector and Embedding Weaknesses

Medium

Security vulnerabilities in Retrieval-Augmented Generation (RAG) systems, vector databases, and embedding pipelines.

Attack Types
  • RAG Injection: Malicious content in retrieved documents
  • Vector DB Compromise: Attacking vector storage
  • Embedding Extraction: Stealing embedding representations
  • Context Manipulation: Corrupting retrieval results
Attack Examples
  • Poisoned documents being retrieved as top results
  • Vector database unauthorized access
  • Extracting training data from embeddings
  • Retrieval manipulation via embedding attacks
Mitigation Strategies
  • Validate and sanitize all RAG input documents
  • Implement vector database access controls
  • Use embedding encryption where available
  • Apply reranking with security filters
  • Monitor retrieval for anomalies
LLM09

Misinformation

Medium

LLMs generating false, misleading, or biased content that appears credible, leading to informed decisions based on incorrect information.

Attack Types
  • Hallucinations: Confident but false outputs
  • Factual Errors: Incorrect information presented as fact
  • Bias Amplification: Reinforcing existing biases
  • Manipulation: Deliberate misleading outputs
Attack Examples
  • Citing non-existent research papers
  • Providing incorrect medical advice
  • Generating biased hiring recommendations
  • Creating fake news or reviews
Mitigation Strategies
  • Implement fact-checking pipelines
  • Use confidence scoring and uncertainty estimation
  • Apply source verification for critical outputs
  • Add content provenance and attribution
  • Label AI-generated content clearly
LLM10

Unbounded Consumption

Medium

Allowing excessive or uncontrolled resource usage by LLM applications, leading to denial of service, financial exploitation, or service degradation.

Attack Types
  • API Rate Abuse: Excessive API calls exhausting quotas
  • Resource Exhaustion: Maxing out compute resources
  • Cost Exploitation: Pay-per-token abuse leading to charges
  • Inference Attacks: Extracting model via excessive queries
Attack Examples
  • Automated attacks consuming entire API quota
  • Max-length prompt spam causing compute exhaustion
  • Extracting model through millions of queries
  • Recursive prompt loops consuming resources
Mitigation Strategies
  • Implement strict rate limiting and quotas
  • Add input/output token limits
  • Monitor usage patterns for anomalies
  • Use cost controls and budget alerts
  • Apply timeout controls on long-running operations

OWASP Testing Framework

Follow this structured approach for testing each vulnerability:

1. Reconnaissance

  • Map system architecture and data flow
  • Identify input points and API interfaces
  • Document integrated tools and plugins
  • Review system prompts and configuration

2. Vulnerability Mapping

  • Test each OWASP category systematically
  • Document attack surface and entry points
  • Identify defense mechanisms in place
  • Map dependencies and third-party services

3. Exploitation

  • Conduct proof-of-concept attacks
  • Document exploitability and impact
  • Test chaining multiple vulnerabilities
  • Assess real-world attack feasibility

4. Reporting

  • Prioritize findings by risk level
  • Provide remediation recommendations
  • Include proof-of-concept code
  • Suggest defensive improvements

Official Resources

Sources & Statistics

Related Articles

Related Resources

AH
AI Hacking Team

The AI Hacking team researches and documents AI/LLM security vulnerabilities, red teaming techniques, and defensive strategies. Our guides are based on real-world pentesting experience and continuous monitoring of the AI security landscape.

Frequently Asked Questions

What is the OWASP LLM Top 10?
The OWASP LLM Top 10 is a consensus list of the most critical security vulnerabilities in Large Language Model applications, maintained by the OWASP community. It covers risks like prompt injection, insecure output handling, training data poisoning, supply chain vulnerabilities, and more.
What is prompt injection (LLM01)?
Prompt injection is the #1 LLM security risk where attackers manipulate AI models through malicious inputs to override system instructions, extract sensitive data, or bypass safety controls. It includes direct injection (via user prompts) and indirect injection (via external data sources).
What changed in the OWASP LLM Top 10 2026?
The 2026 release broadens the list to cover agentic and retrieval systems. Sensitive Information Disclosure moves up to LLM02, Supply Chain Vulnerabilities to LLM03, and Data and Model Poisoning to LLM04. Improper Output Handling replaces Insecure Output Handling at LLM05, and three agent-era categories appear: System Prompt Leakage (LLM07), Vector and Embedding Weaknesses (LLM08), and Misinformation (LLM09).
How can I protect against LLM supply chain vulnerabilities?
Protect against LLM supply chain risks by: vetting third-party models and datasets before use, using pinned versions and hash verification, monitoring for malicious packages in PyPI/npm/Hugging Face, implementing software composition analysis for AI dependencies, and maintaining an inventory of all AI/ML components in your pipeline.
What percentage of AI deployments have critical vulnerabilities?
According to OWASP's State of AI Security report, 73% of AI deployments have critical vulnerabilities. Additionally, 41% of enterprise AI systems have unauthenticated APIs, and virtually 100% of LLM deployments are exploitable via prompt injection.
What is sensitive information disclosure in LLMs?
Sensitive information disclosure occurs when LLMs inadvertently reveal confidential data from their training data, system prompts, or retrieved context. This can expose API keys, internal business logic, personally identifiable information (PII), and proprietary algorithms through carefully crafted prompts.
How do I secure LLM APIs?
Secure LLM APIs by implementing authentication and rate limiting, validating and sanitizing all inputs, filtering outputs for sensitive data, using separate endpoints for different trust levels, logging all API interactions, and avoiding the inclusion of sensitive data in system prompts.

Stay Ahead of AI Security

Get the latest AI/LLM security research, OWASP updates, and new vulnerabilities delivered straight to your inbox.