The OWASP Top 10 for LLM Applications 2026 ranks Prompt Injection first, Sensitive Information Disclosure second and Excessive Agency third, and renames System Prompt Leakage to Hidden Context Exposure. For an AI MVP each risk becomes one pre-launch test and one control to keep: least-privilege tools, authorization before retrieval, hard spending caps, output encoding and human approval for high-impact actions. OWASP says no reliable prevention for prompt injection exists today, so the defense is architectural.
The short answer
The OWASP Top 10 for LLM Applications 2026 names ten risks for applications built on language models, with Prompt Injection first, Sensitive Information Disclosure second and Excessive Agency third. For an AI MVP, the practical way to use it is to turn each risk into one test you run before launch and one control you keep after it. The tables below do that, using OWASP's own mitigation guidance and our mapping to MVP-sized work.
OWASP posted the 2026 edition on August 3, 2026 and announced it on September 2, 2026. A search we ran on October 17, 2026 returned checklists that described the 2023 and 2025 editions, so check which edition a checklist uses before you rely on its numbering.
What changed from 2025 to 2026
| 2026 entry | 2025 rank | Movement |
|---|---|---|
| LLM01 Prompt Injection | 1 | Held first; now also covers cross-modal attacks such as instructions hidden in an image or an audio track |
| LLM02 Sensitive Information Disclosure | 2 | Held second |
| LLM03 Excessive Agency | 6 | Climbed to third, the largest move on the list |
| LLM04 Supply Chain | 3 | Down one; now covers a promoted model artifact that is not what it claims to be |
| LLM05 Data and Model Poisoning | 4 | Down one; now absorbs fine-tuning subversion |
| LLM06 Unbounded Consumption | 10 | Rose four places |
| LLM07 Misinformation | 9 | Up two |
| LLM08 Hidden Context Exposure | 7 | Renamed from System Prompt Leakage, with a broader scope |
| LLM09 Vector and Embedding Weaknesses | 8 | Down one |
| LLM10 Improper Output Handling | 5 | Fell furthest, from fifth to tenth; now spans insecure code that assistants generate |
The 2025 ranks and the 2026 order come from OWASP's two published lists; the notes on what each entry now covers are OWASP's, in our words. One boundary matters for MVPs: OWASP says this list owns the risk when the model is a component inside your application. Once the model acts, with tools it can call and memory it carries between sessions, the risk moves to the OWASP Top 10 for Agentic Applications, covered below.
The ten risks as pre-launch tests
| Risk | What it looks like in an MVP | Test before launch (our mapping) | Control to keep (from OWASP's mitigations) |
|---|---|---|---|
| LLM01 Prompt Injection | A support bot obeys instructions hidden in an uploaded PDF or a retrieved web page | Plant hostile instructions in every input channel: the user message, an uploaded file, a retrieved page and a tool result. Confirm none of them triggers a tool call or data access outside the allow-list | OWASP says no reliable prevention exists, so defend with architecture: least-privilege credentials held in application code, validated output schemas, a separate channel for external content, and human confirmation before privileged or irreversible actions |
| LLM02 Sensitive Information Disclosure | One customer's data appears in another customer's answer, or secrets show up in logs | Ask as tenant A for tenant B's records, for API keys and for the system prompt. Search logs and traces for personal data | Authorize inside the index query before retrieval, send the provider only the fields the task needs, keep secrets out of prompts, and scrub logs before they reach monitoring |
| LLM03 Excessive Agency | An agent with a shell or a mailbox can do more than the task needs | List every tool with its permissions. Try to make the agent delete, send or pay without approval | Minimize tools, tool functionality and permissions; avoid open-ended tools such as a shell or a fetch-any-URL; require approval for high-impact actions |
| LLM04 Supply Chain | A model, plugin or AI-suggested package is not what it claims to be | Inventory every model, dataset, library and plugin. Check that each AI-suggested dependency exists and is the package you intended | Vet suppliers, scan and patch components, and keep a bill of materials that extends to models and datasets, with licenses tracked in the same list |
| LLM05 Data and Model Poisoning | Bad documents or feedback change the model's behavior | Trace what feeds fine-tuning, embeddings and feedback loops. Add a poisoned document to a staging corpus and see what surfaces | Track data lineage, validate incoming data, filter retrieved content and control automated retraining |
| LLM06 Unbounded Consumption | One user, or a loop, runs up the bill or takes the service down | Send oversized and repeated requests. Confirm limits trip before inference starts. Estimate the cost of one request | Limit tokens per minute, tokens per day and estimated cost per request; set hard spending caps that stop inference rather than only alert; degrade gracefully |
| LLM07 Misinformation | A confident wrong answer drives a decision | Run the evaluation set with adversarial and out-of-corpus questions. Confirm the product cites a source or declines | Ground claims in authoritative sources, validate tool calls, require structured outputs with mandatory fields, and verify at runtime before high-impact actions |
| LLM08 Hidden Context Exposure | A user extracts the system prompt, or a rule that lives only in the prompt is bypassed | Assume everything in context can reach a user. Try extraction prompts. Confirm no secret or access rule exists only in the prompt | Keep credentials out of hidden context, and enforce required behavior and authorization in deterministic code outside the model |
| LLM09 Vector and Embedding Weaknesses | A retrieval index leaks one tenant's chunks to another, or ingests hidden text | Query as tenant A for tenant B's content. Ingest a document with white-on-white text and see whether it reaches the model | Scope tenants inside the index query, record provenance for every embedding, and separate indexes by trust tier |
| LLM10 Improper Output Handling | Model output is rendered as HTML or run as SQL or shell | Make the model emit script tags, markdown links, SQL and control characters. Confirm the app encodes or validates them | Treat model output like user input: validate it, encode it for where it is used, use parameterized queries and set a strict content security policy |
For a retrieval chatbot, the rows to run first are LLM02, LLM09, LLM01 and LLM10; our guide to building an AI chatbot MVP covers the retrieval side. For cost control under LLM06, the AI MVP cost guide shows what a request costs at current list prices.
When your product acts, add the Agentic Top 10
If your MVP is an agent that calls tools, reads memory or talks to other agents, pair the list above with the OWASP Top 10 for Agentic Applications 2026, announced on December 9, 2025. Its ten entries are ASI01 Agent Goal Hijack, ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse, ASI04 Agentic Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution, ASI06 Memory and Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation and ASI10 Rogue Agents.
Two design rules from OWASP's prompt injection guidance are cheap to apply early. The "lethal trifecta", a term from Simon Willison that OWASP cites, is an agent that can access private data, ingest untrusted content and communicate externally at the same time; removing any one of the three removes the conditions for high-impact exploitation. Meta AI's "Rule of Two", also cited by OWASP, turns that into a budget: treat untrusted input, sensitive data, and the ability to change state or communicate externally as three capabilities. An agent that has all three needs per-action human approval, and any two need an explicit residual-risk assessment.
If you are exposing your own tools to agents, the MCP server development page covers tool design, and AI agent development covers guardrails and approval steps.
A launch gate for an AI MVP
Ten yes-or-no checks, our recommendation, one per risk. Do not ship while any answer is "no" or "unknown".
- Every tool the model can call is listed with its permissions, and none is open-ended.
- Credentials and the ability to change state live in application code, not in the prompt or the model.
- Untrusted content (uploads, web pages, retrieved text) arrives through a separate, labelled channel and cannot trigger a privileged action on its own.
- Privileged, irreversible or externally visible actions need a human confirmation that shows the exact action.
- Retrieval authorizes inside the index query, per tenant, and cross-tenant queries were tested.
- No secret or access rule exists only in a prompt.
- Model output is validated and encoded for where it is used, and is never executed.
- Rate limits count tokens and cost, and a hard spending cap stops inference.
- A written inventory covers models, datasets, libraries and plugins, with licenses.
- An evaluation set covers adversarial and out-of-corpus questions, and its pass mark was set before the run.
In a 2 to 3 week build, this gate belongs in the final week with testing and launch preparation. The wider AI MVP launch checklist lists the rest of what to verify before going live.
What no checklist fixes
OWASP is direct about one limit: prompt injection is intrinsic to current generative AI, because models make no architectural distinction between instructions and data, and no reliable prevention mechanism exists today. Its guidance is defense in depth, with some controls that reduce injection success and others that limit what a successful injection can do. Design for the day the model is fooled. A longer system prompt is a partial control at best.
The list is also an awareness baseline, not a certification. Passing ten tests on launch day does not cover the next model change, a new tool or a new data source, so rerun the gate when any of those change, and keep watching production: see LLM evaluation and testing and AI observability and monitoring.
Security is one of three things a founder should settle before an AI product reaches users. The other two are who owns the code (who owns your MVP code) and which regulations apply (EU AI Act for AI MVP founders).
Sources
All pages were read on October 17, 2026. OWASP material is licensed CC BY-SA 4.0; the summaries here are in our own words, with attribution.
- OWASP Top 10 for LLM Applications 2026, OWASP GenAI Security Project, resource page dated August 3, 2026
- OWASP announcement of the 2026 Top 10 for LLM Applications, September 2, 2026
- OWASP Top 10 for LLM Applications 2025, the previous edition
- OWASP Top 10 for Agentic Applications for 2026, December 9, 2025
- GenAI and Agentic AI Exploit Roundup Q3 2026, which lists the Agentic Top 10 entries by number
This page is general information from OWASP's published guidance, not a security audit of your product.