OWASP LLM Top 10 2026: what changed and what the evidence shows

August 2026

The OWASP LLM Top 10 ranks the risks that matter most when software calls a language model. OWASP updated it on 3 August 2026: every entry survived, eight moved position and one was renamed (OWASP, 2026). A second list, the Top 10 for Agentic Applications, covers what happens once that model can use tools, hold memory and act on its own.

This edition is also the first where the ranking was tested against a record of real incidents rather than resting on a community vote alone. That test placed prompt injection first on the vote and outside the top ten on the incident record, and OWASP kept it at number one. If you want the wider picture around these risks, the AI security field guide covers the ground this list sits on.

The eight entries that changed position

OWASP published the 2026 Top 10 for LLM Applications on 3 August. No entry was dropped and none was added. Eight of the ten changed position, four of them by a single place because something climbed past them.

Excessive Agency climbed from sixth to third, which OWASP calls the most consequential move on the list. An LLM answering questions and an LLM with tool access, memory and the ability to act are different risk propositions, and the ranking now says so.

Improper Output Handling fell from fifth to tenth, the largest drop in the edition, and widened on the way down. It now covers the insecure code that coding assistants generate at scale.

System Prompt Leakage is now Hidden Context Exposure, and moved from seventh to eighth. The rename widens the entry beyond system prompts to the surrounding context an application holds. Any control mapping pointed at LLM07:2025 now points at Misinformation.

Why the order moved

Earlier editions ranked by community vote. The 2026 edition is the first to test that vote against a corpus of 7,714 recorded incidents drawn from public vulnerability databases and an AI-harm database, of which 6,639 carried enough detail to classify (OWASP, 2026). The vote was weighted at three quarters, the incident data at one.

Prompt injection came first on the vote. Ranked on the incident record alone, it falls out of the top ten entirely. Misinformation diverged the other way, low on the vote and high on the record, and was seated between them at seventh.

OWASP held prompt injection at LLM01 and reads that gap as a defence effect: teams already spend heavily keeping injection out, so fewer clean exploits reach a public database and the count understates the risk.

The project leads are open about why the vote won. They write that the list is a consensus product and that one noisy year of data should not overturn the judgement of the people doing the work. A quarter weight, they say, is enough to move an entry a tier where belief and evidence diverge, and not enough to let imperfect data rewrite the list on its own.

Prompt injection and misinformation are the only entries whose position in the incident record the 2026 document states. It carries no per-category counts, so for the other eight a reader cannot set the ranking against the record.

The incidents a CVE-driven process never sees

Separately from the Top 10, OWASP publishes a periodic exploit round-up, and it is more specific about the evidence base than the list is. Most AI-related security events, it says, are not mapped to traditional CVE identifiers, arising instead from misconfiguration, design flaws, supply-chain weaknesses and prompt injection. On OWASP's reading, only classical software vulnerabilities embedded in AI platforms receive CVE tracking consistently. In OWASP's Q1 2026 round-up, one of the eight incidents carried a CVE. OWASP describes that round-up as a selection of major incidents rather than an exhaustive list, so eight is a curated set and not a sample.

Unit 42 published research on 31 March 2026 showing that a single over-permissioned service agent in Google's Vertex AI could be used to read every Cloud Storage bucket in a customer project, and to reach restricted images and source code inside Google's own infrastructure. The technique uses no exploit. It queries Google Cloud's standard metadata service for credentials that were already scoped too widely. Google's response was to update its documentation and recommend customers supply their own service account. There is no CVE and no patch.

In August 2025 Microsoft assigned CVE-2025-53773 to a flaw in GitHub Copilot, CVSS 7.8, after a researcher showed the agent could be induced to write a setting into a project's own configuration file that disabled every user confirmation. That is the case OWASP describes: a classical software defect sitting inside an AI platform. Microsoft did not filter the injected instruction. It moved the setting out of workspace configuration and into the global profile, where the model cannot write.

Deloitte Australia delivered a 237-page assurance review to the Department of Employment and Workplace Relations under a contract worth A$440,000, and agreed to repay the final instalment after a University of Sydney researcher identified around twenty fabricated references, including a quote attributed to a Federal Court judgment that does not exist. The corrected report discloses that the work used an Azure OpenAI GPT-4o toolchain. Deloitte has not attributed the errors to the model. Nothing was defective and nothing was patched. No CVE was issued, and it is hard to see what one would have described.

Unbounded Consumption rose four places to sixth, the largest climb in the edition. Its 2026 entry supports that with eight worked attack scenarios and one citation between them. Documented incidents do exist: Sysdig's threat research team published the LLMjacking campaign in May 2024, in which credentials stolen through an unpatched Laravel flaw were used to run ten cloud-hosted LLM services at other organisations' expense, with one victim billed 30,000 dollars in three hours.

What to change on your side

Recheck anything that cites an LLM number. A stale mapping does not break, it resolves: eight of the ten numbers now point at a different risk, so a control you filed under LLM03 Supply Chain now sits under Excessive Agency. OWASP documents the move; your tooling will not flag it.

Decide which list you are working from. Once a model holds tools, memory and the ability to act, OWASP hands the risk to its separate Top 10 for Agentic Applications, and the security risks specific to AI agents sit on that side of the line. Counting the crosswalk in the 2026 document, prompt injection and excessive agency each reach seven of the ten agentic risks. No other entry reaches more than three. If you are standing agents up, those two are where the work concentrates.

Then check what puts a risk in front of you in the first place. Of the three incidents in this piece, one carried a CVE. The other two were public, dated and attributable to a named organisation, and neither would ever reach a queue that waits for an identifier.

References and Sources

1. OWASP GenAI Security Project. (2026). OWASP Top 10 for LLM Applications 2026, v1.0. Rankings, the crosswalk to the Top 10 for Agentic Applications, and the methodology summary in the Letter from the Project Leads. Corpus of 7,714 recorded incidents, 6,639 classified; community vote weighted at three quarters against one quarter incident data.
2. OWASP GenAI Security Project. (2026). GenAI Exploit Round-up, Q1 2026. Eight incidents, one carrying a CVE. Described by OWASP as a selection of major incidents rather than an exhaustive list.
3. Unit 42, Palo Alto Networks. (2026). Model Namespace and Vertex AI service agent research, 31 March 2026. Over-permissioned Per-Project Per-Product Service Agent reaching customer storage and Google-owned Artifact Registry. No CVE assigned; remediated by documentation change and a Bring Your Own Service Account recommendation.
4. Microsoft Security Response Center. (2025). CVE-2025-53773, GitHub Copilot, CVSS 7.8, August 2025. Prompt injection writing to workspace configuration. Reported by Johann Rehberger, Embrace The Red, and disclosed alongside other researchers. Attack vector local, user interaction required.
5. Sysdig Threat Research Team. (2024). LLMjacking, 6 May 2024, author
   Alessandro Brucato. Stolen cloud credentials via CVE-2021-3129 used against ten hosted LLM services. One victim billed 30,000 dollars in three hours, per Sysdig's 2024 Global Threat Year-in-Review.
6. Department of Employment and Workplace Relations, Australia / Deloitte. (2025).
   Targeted Compliance Framework Assurance Review, corrected version dated
   26 September 2025. Discloses use of an Azure OpenAI GPT-4o toolchain. Fabricated references identified by Dr Christopher Rudge, University of Sydney.