OWASP LLM Top 10 2026: Excessive Agency, Supply Chain Up, Output Handling Out

OWASP published the 2026 edition of its LLM Top 10 on August 4, and it reads differently from previous versions — not just in rankings but in philosophy. For the first time, the list was shaped partly by real incident data rather than practitioner consensus alone, and the resulting divergences between what experts vote for and what actually shows up in breach reports are worth paying attention to.

The existing AI Security Wire article on the OWASP LLM Top 10 v2.0 covered the 2025 framework. What follows covers what changed and why it matters for teams building or securing AI systems in 2026.

How the Methodology Changed

Previous editions relied entirely on community voting from AI security practitioners. The 2026 edition kept that as the dominant signal (75% weight) but added a new component: 25% drawn from nearly 8,000 documented real-world AI security incidents pulled from public vulnerability databases and an AI-harm database.

The practical effect is that the list now shows where actual breaches are happening, not just what practitioners worry about. In some cases these converge. In others — like Misinformation and Improper Output Handling — they diverge sharply, and that divergence is informative.

The 2026 Rankings

Rank	Entry	Change
1	Prompt Injection	Unchanged
2	Sensitive Information Disclosure	Unchanged
3	Excessive Agency	Up
4	Supply Chain	Renamed and expanded
5	Data and Model Poisoning	Up
6	Unbounded Consumption	Up 4
7	Misinformation	Largest expert-vs-evidence gap
8	Hidden Context Exposure	Renamed from System Prompt Leakage
9	Vector and Embedding Weaknesses	Expanded scope
10	Improper Output Handling	Down 5

Prompt Injection stays at number one, though the incident data tells an interesting story: clean, exploited injection vulnerabilities don’t appear in public breach reports at anywhere near the rate experts expect. The reason, per the OWASP project leads, is that teams building LLM applications in production fight injection so aggressively that successful attacks rarely become public incidents. That’s reassuring and also worth not becoming complacent about.

Excessive Agency at third place is the clearest signal about where the threat landscape has moved. With LLMs increasingly deployed as agents — with access to tools, code interpreters, email systems, and databases — the blast radius of a successful prompt injection or misuse scenario is no longer just a bad model response. It’s an action taken in the real world. The incident data backs this: autonomous LLM tool misuse is a genuine, recurring breach category now.

Supply Chain moved to fourth and was significantly expanded. The original entry was narrow in scope. The 2026 version encompasses the full AI supply chain: model weights from public registries, third-party fine-tuning services, pre-trained components, dataset provenance, and plugin/tool ecosystems. Given the growth of model marketplaces and the documented cases of trojanised weights and poisoned datasets, this expansion is warranted.

Unbounded Consumption jumping four places reflects growing practitioner concern about resource exhaustion, cost control, and denial-of-service in AI systems. As organisations run inference at scale, attackers have found that flooding an LLM API with expensive requests is a practical DoS vector — and one that hits the wallet before it hits availability monitors.

Misinformation at seventh showed the largest gap between practitioner votes and incident data. Voters ranked it lower; evidence pushed it higher. The OWASP team’s framing: “When a model produces fluent, confident output that drives a real decision or action, a wrong answer becomes a wrong outcome.” In finance, healthcare, and legal contexts, that framing applies directly.

Hidden Context Exposure (formerly System Prompt Leakage) at eighth reflects a scope broadening. Attackers aren’t just trying to extract system prompts — they’re after any context the model has access to: injected RAG documents, conversation history, tool schemas, memory contents. The rename acknowledges that the attack surface is wider than a single instruction block.

Improper Output Handling dropping to tenth is perhaps the most counterintuitive change. It’s not that output handling vulnerabilities don’t exist — it’s that practitioners have largely absorbed them. Frameworks sanitise model outputs, downstream systems apply their own validation, and the category appears infrequently in real incident data. It’s a solved problem in enough production deployments that it’s no longer a top priority.

The Central Idea Shift

The clearest signal in the 2026 edition isn’t any individual ranking. It’s the framing around the project’s core philosophy: “Stop trying to build a model that cannot be fooled. Build the system around it, so that when the model is fooled — and it will be — nothing important breaks.”

That’s a meaningful reframe for teams that have been focused on model-level hardening: jailbreak resistance, instruction hierarchy, safety training. Those things matter, but the 2026 evidence suggests the security wins come from architectural controls — least privilege for agent tool access, output validation in downstream systems, blast-radius containment for autonomous actions — rather than from any assumption that the model itself is the last line of defence.

The full 2026 document includes Appendix A, which maps all ten risks to MITRE ATT&CK, NIST AI RMF, OWASP ASVS, and CSA CCM frameworks. For teams that need to communicate AI security priorities to a compliance or audit function, that mapping is practically useful.

References

• Help Net Security — OWASP 2026 LLM Top 10: “The model will be fooled”
• OWASP GenAI — LLM Top 10 2026 Resource
• Cybersecurity News — OWASP Releases GenAI LLM Top 10 2026
• TechTimes — OWASP LLM Top 10 2026 Incident Data Overrules Experts on Misinformation Risk