OWASP’s 2026 LLM Top 10 shifts risk priorities

OWASP’s 2026 LLM Top 10 uses incident data to reorder the biggest AI app risks.

OWASP’s 2026 list blends expert voting with 6,639 documented incidents, and that change moved misinformation up while confirming the top threats.

1. Prompt Injection

OWASP kept Prompt Injection at number one even though the incident database showed relatively few recorded cases. The reason is a defense effect: teams spend heavily to block it, so successful attacks are undercounted.

The 2026 scope also expands beyond plain text. Attackers can hide instructions in images or audio, then feed them into systems that treat everything as one token stream. That is why the problem keeps winning the top slot.

• Hidden instructions in images
• Hidden instructions in audio
• System prompts mixed with user content

2. Sensitive Information Disclosure

Sensitive Information Disclosure held second place, but the real story is how the exposure surface widened. It is no longer just about memorized training data leaking back to users.

In production systems, the bigger failures often come from retrieval pipelines, multi-tenant cache mix-ups, and system prompt leakage. Those bugs can expose one customer’s data, internal business logic, or security constraints to another user.

• Wrong-tenant retrieval in RAG systems
• Cached responses crossing user boundaries
• Hidden context leaking through prompts or tools

3. Excessive Agency

OWASP moved Excessive Agency from sixth to third, and both experts and incident data pointed the same way. Agentic systems are causing real damage because they can do more than answer questions.

The category breaks into three controls: too many tools, too much permission, and too much autonomy. If a model can write files, send messages, or call APIs without approval, every other weakness becomes more expensive to fix.

4. Misinformation

Misinformation is the most interesting ranking jump in the 2026 list. Experts placed it near the bottom, but incident data pushed it from ninth to seventh because real-world failures were showing up more often than the voting suggested.

The issue is not just bad answers. In agentic workflows, one wrong output can become a wrong tool call, then a wrong decision, then a real operational or financial loss. That makes misinformation a system failure, not a harmless chat error.

• Believable but false model output
• Bad code generation passed downstream
• Wrong system state inferred by agents

5. Data and Model Poisoning

Data and Model Poisoning absorbed fine-tuning subversion in the 2026 edition, which is a useful signal about where attackers can interfere. The attack surface now spans pretraining data, fine-tuning pipelines, and retrieval stores used by RAG systems.

That broader scope matters because poisoning is not one bug class anymore. A corrupted dataset, a tainted fine-tune, or a compromised retrieval source can all steer behavior in the same bad direction.

• Pretraining data contamination
• Fine-tuning pipeline tampering
• Retrieval store poisoning

6. Unbounded Consumption

Unbounded Consumption rose four places as enterprises started treating inference cost and resource drain as a real operational risk. When an AI system can run expensive loops, generate huge outputs, or trigger repeated calls, the bill becomes part of the attack.

This category is easy to ignore until it hits production. Security teams now have to think about cost exhaustion the same way they think about denial of service: if an attacker can burn compute, they can still hurt the business.

7. Hidden Context Exposure

System Prompt Leakage was renamed Hidden Context Exposure to match the real target. The sensitive material at risk includes business logic, internal configs, retrieval rules, and API keys inside tool definitions, not just the system prompt itself.

The rename matters because it broadens the defense model. If hidden context is part of the attack surface, then access control, prompt design, and tool configuration all need the same attention.

• Business logic in prompts
• API keys in tool definitions
• Retrieval pipeline details

8. Output Handling

Output Handling fell to tenth place while absorbing a wider set of validation concerns. The lower rank does not mean the category is unimportant; it means some of the old output risks are now being counted elsewhere.

For developers, the lesson is straightforward: treat model output as untrusted input. Validate it before it reaches code execution, database writes, user-visible actions, or other sensitive systems.

What to pick

If you are building a chat app, start with Prompt Injection, Sensitive Information Disclosure, and Hidden Context Exposure. If you are building agents, put Excessive Agency and Misinformation near the top of your review.

If you need one planning rule from the 2026 list, it is this: do not ask whether the model can be fooled. Ask what a fooled model can reach, change, or spend.