Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Prompt injection has held #1 across every edition of this list. What moved in 2026, Excessive Agency jumping to third, and why it matters as LLMs increasingly act, not just answer.
The OWASP GenAI Security Project published its 2026 Top 10 for LLM Applications on August 4, 2026, downloaded more than 10,000 times in its first 48 hours, built from contributions across a community that's now grown past 30,000 members. It's the closest thing the industry has to an OWASP Top 10-equivalent standard for AI applications, and it's worth understanding for exactly the reason the original OWASP Top 10 mattered: it names the categories of real, exploitable risk that keep showing up in production systems, ranked by how often and how severely they actually cause harm.
Prompt Injection (LLM01) has held the top position across every published edition of this list, from the original 2023/24 version through 2025 and now 2026. The reason it's structural, not a fixable bug: any point where a model processes untrusted text, a user's direct input, a document it's asked to summarize, a webpage it's asked to browse, an email it's asked to draft a reply to, is a potential injection point, because the model has no reliable way to distinguish "instructions from my developer" from "text that happens to contain something that looks like an instruction." Patching a specific injection technique doesn't close the category; it just narrows one path into a very large door.
Excessive Agency (LLM03) climbed from sixth to third, a significant jump, and not a coincidence. As LLM-powered systems increasingly act as agents, autonomously executing shell commands, calling external APIs, or managing database transactions rather than just generating text for a human to read and act on, the blast radius of a successful prompt injection stopped being "the model says something wrong" and became "the model does something wrong," with real, direct consequences. Unbounded Consumption (LLM06) rose four places, from tenth to sixth, reflecting emerging denial-of-service and financial-drain risks specific to extended-reasoning models and shared inference infrastructure, an attacker who can force a model into expensive, looping computation is running a resource-exhaustion attack against a system billed by the token. Misinformation climbed as well, after real incident data showed confidently-wrong AI output triggering downstream automated actions, an unauthorized API call or a bad business decision made on the model's say-so, not just a wrong answer a human happened to read.
A lot of what shows up in the 2026 list maps onto risk categories security teams already understand, applied to a new execution layer. Excessive Agency is, at its core, an authorization problem, the same discipline behind broken access control and IDOR, just applied to what actions an AI agent is permitted to take rather than what data a user account can reach. Supply Chain (LLM04) risk in an AI context, a compromised or poisoned third-party model, dataset, or plugin, is a direct extension of the same reasoning behind our piece on third-party and supply chain risk. And Sensitive Information Disclosure (LLM02), where a model trained or fine-tuned on internal data leaks it back out through its responses, is a new delivery mechanism for a very old problem: data that shouldn't be exposed, ending up exposed.
If your product or internal tooling has shipped an LLM-powered feature, a chatbot, a document-summarization tool, an agent with API or database access, that feature has a real, testable attack surface that a standard web application penetration test wasn't built to cover. Testing it means treating every point where the model ingests external content as untrusted input, and treating every action the model is permitted to take autonomously as something requiring the same least-privilege scrutiny as a human user's permissions would get. Our AI Services and Penetration Testing offerings cover exactly this kind of assessment, reviewing what an LLM-powered feature can actually be made to do, not just whether the surrounding application is secure in the traditional sense.
Tell us about your environment and goals, we'll help you scope the right engagement.