OWASP LLM Top 10

The OWASP Top 10 for Large Language Model Applications names ten risk categories LLM application teams should consider during design, development, and operation. The current list, the 2026 edition published in August 2026, is: prompt injection, sensitive information disclosure, excessive agency, supply chain, data and model poisoning, unbounded consumption, misinformation, hidden context exposure, vector and embedding weaknesses, and improper output handling (LLM01:2026 to LLM10:2026). It renumbered the 2025 list, so each id carries its year: excessive agency is LLM03:2026 and was LLM06:2025, and hidden context exposure succeeds system prompt leakage.

It covers the application layer: prompts, integration code, retrieval pipelines, output handling. It does not cover the model weights, the foundation-model training process, or organizational AI governance — those are addressed by different frameworks (OWASP Agentic Top 10 for agent-specific risk, ISO 42001 or NIST AI RMF for governance).

Referencing the OWASP LLM Top 10 in a security review is design-time evidence that LLM-specific risk categories were considered. Referencing it without a control mapping — the specific control, the lifecycle gate it applies at, and the evidence that demonstrates it's operating — is naming the framework, not assessing against it.

A useful assessment produces a structured table for the assessed system: for each of the ten items, the applicable controls, the lifecycle gate by which each should be in place, current evidence status, and any residual risk the AI Committee has explicitly accepted. That table, not a checked-box list of ten items, is what a defensible review actually needs.

Agentic systems need both this taxonomy and the OWASP Agentic Top 10 — the LLM Top 10 covers risks in LLM applications generally; the Agentic Top 10 covers risks that emerge specifically from tool use, delegation, and autonomous action. Non-agentic LLM applications need only the LLM Top 10.