OWASP LLM Top 10 2026: 7,714 incidents analyzed – and the #1 risk almost didn’t make it

The 2026 edition adds incident data – and this methodology change is the real news

As with previous editions, the community vote is still the backbone of the list. What’s new is a data-based check on it: a corpus of 7,714 real LLM-related incidents pulled from public vulnerability databases, of which 6,639 carried enough detail to classify. The idea was to check – now that a meaningful body of LLM incident data was available – whether practitioners’ fears match what is actually going wrong in production.

The two data sources are weighted, and the weighting is deliberately conservative: the vote carries three-quarters, the incident data one-quarter. One year of incident data doesn’t override the judgment of hundreds of practitioners who attack and defend these systems daily – but when belief and evidence diverge sharply, even a quarter-weight is enough to shift an entry up or down. That’s exactly what happened in two places, and those two places are possibly the most useful findings in the document.

The prompt injection paradox: Fewer recorded incidents despite greater real-world risk

Practitioners voted prompt injection the number one risk, while raw incident record alone would have dropped it out of the top 10 entirely – and there’s a good reason for the discrepancy.

Prompt injection is the oldest and best-known class of LLM-specific vulnerabilities. Mature security teams fight it relentlessly, model and application developers are aware of it, and meaningful mitigations exist – all of which means fewer clean exploits reach public databases. The low incident count is a measure of defensive spend, not of a shrinking risk. The authors call it a “defense effect,” and it’s the main reason the entry holds the top spot despite the data gap.

At the same time, the realistic attack surface is expanding. Cross-modal injection – instructions hidden in images, audio, or video – is an increasingly viable and mostly undefended vector. Every new MCP server connection and every agentic integration adds another surface the model reads without a trust boundary. An injection written to persistent memory or a RAG corpus doesn’t expire after a single session but taints every future interaction that reads from that store. Prompt injection is simply an inevitable aspect of LLM usage:

“The surface still sits everywhere a model reads untrusted input, which is to say everywhere.”
– OWASP Top 10 for LLM Applications 2026

The reason prompt injection is still number one is the same reason you can’t deprioritize it: low incident counts mean the defenses are working, not that the work is done.

Underestimate misinformation at your own peril

Misinformation is the mirror image of prompt injection, and it’s the finding that should probably make teams uncomfortable. Practitioners placed it near the bottom of the vote, yet the incident record placed it near the top – the widest gap in the list, and in the dangerous direction.

The 2025 entry framed this mostly as a problem of users overly trusting fluent output, but that framing is now too narrow. In 2026, model outputs drive tool calls, generate production code, authorize actions, and coordinate other agents. A wrong answer fed into that chain doesn’t stop in the user’s chat box but often becomes a wrong action in a downstream system. The authors put it plainly:

“When a model’s fluent, confident output drives a decision or a tool call, a wrong answer turns into a wrong action, and the record says that failure lands more often than the vote assumes.”
– OWASP Top 10 for LLM Applications 2026

Consider a scenario where a developer assistant is asked to assess the state of a codebase and file issues for anything that looks broken. If the model hallucinates a vulnerability that doesn’t exist and files a critical-severity ticket, an on-call engineer may spend three hours investigating a ghost finding. Multiply that by an agentic pipeline with write access to production systems and you’re looking at entirely new failure modes at scale.

The gap between the vote and the data is a signal that many teams are calibrating their misinformation risk against how LLMs were used in the past, not how they’re being used now. For the 2026 list, Misinformation moved up two places, and that’s probably still conservative.

The ranking moves that reflect daily AI reality

Three other changes in the list are a direct read of where AI usage has gone in the past year.

Excessive Agency climbed from sixth to third – the biggest move on the list, and the one where the vote and the incident data agree most clearly. Agentic deployments are where damage is landing. An LLM that can call tools, modify files, send emails, and invoke cloud APIs with the privileges of the user who deployed it is a very different attack surface from a chat interface. The entry now explicitly cross-references the OWASP Agentic Top 10 for cases where the model isn’t just a component but an actor in its own right.

Unbounded Consumption rose from tenth to sixth on the back of a reframe from denial of service to cost asymmetry. Attackers can now trigger disproportionately expensive computation at negligible cost to themselves. Extended-thinking and reasoning models, multimodal requests, and MCP-connected tool chains all multiply the cost of a single crafted input. Rate limiting by request count alone is no longer sufficient. The entry now calls for token-aware cost controls, spending caps, and agent-level circuit breakers:

“Attackers can trigger disproportionately expensive computation at negligible cost to themselves, whether through crafted prompts, stolen credentials, or manipulated workflows.”
– OWASP Top 10 for LLM Applications 2026

Improper Output Handling fell the furthest – from fifth to tenth – but the scope of the entry actually grew. It now covers terminal and IDE sinks that render ANSI escape sequences, and client renderers that auto-fetch external resources referenced in model output as an exfiltration channel. The drop in rank reflects the fact that everything above it became more urgent, not that the risk itself diminished.

Renamed and re-scoped: It’s not just about leaking system prompts

LLM07:2025 System Prompt Leakage has become LLM08:2026 Hidden Context Exposure, and the rename isn’t cosmetic. System Prompt Leakage implied a narrow, containable problem: an attacker extracts your system prompt and now knows your instructions. Hidden Context Exposure points at a broader design principle.

The system prompt is only one part of what the model sees. The full hidden context also includes tool and function schemas, retrieved policy text from RAG pipelines and configuration stores, developer instructions, and any other material assembled into the context window that isn’t visible to the end user. All of it is potentially extractable – and when it is, the consequences extend well beyond knowing the prompt.

The entry frames exposure as an amplifier rather than a standalone risk. Disclosed behavioral logic makes prompt injection more targeted. Leaked tool schemas expand the surface for excessive agency. Embedded credentials in the context window constitute a sensitive information disclosure in their own right. The severity model for Hidden Context Exposure runs from informational through to critical, where disclosure can chain to remote code execution or broad data exfiltration.

The design guidance from the authors is clear and echoes the general wisdom of avoiding security by obscurity:

“Practitioners should design under the assumption that hidden context is discoverable and that any contents of the context should not be considered a secret.”
– OWASP Top 10 for LLM Applications 2026

If your application relies on hidden context remaining hidden as a security control, the 2026 list is telling you to rearchitect that assumption out.

This isn’t the only OWASP document for AI risks anymore

One of the most significant changes for 2026 is a scope boundary the authors drew for the first time to separate models used as software components from models as actors.

The LLM Top 10 covers risk when the model is a component inside your application. The OWASP Top 10 for Agentic Applications (ASI), first published in December 2025, covers risk when the model becomes an actor – with tools it can invoke, memory it carries between sessions, and consequences it can set in motion downstream. The two lists are complementary, not redundant, and the authors explicitly say that neither covers the full picture alone.

If your deployment sits anywhere near an agentic architecture – and in 2026, many do – you need both lists. Excessive Agency and Unbounded Consumption in particular have explicit cross-references to the Agentic Top 10.

Bookmark the 2026 version if you need security framework mappings

One structural change that will matter most to security architects, compliance teams, and CISOs: the per-entry framework links that appeared in every section of the 2025 edition are gone. They’ve been replaced by a single, version-pinned appendix that maps all ten risks to nine external frameworks in one place.

Those nine frameworks are MITRE ATLAS, MITRE ATT&CK, MITRE CWE, NIST AI 600-1, NIST AI Risk Management Framework, OWASP Agentic Top 10 (ASI), OWASP GenAI Data Security (DSGAI), the CSA AI Controls Matrix (AICM), and the OWASP AI Vulnerability Scoring System (AIVSS). Every mapping is drawn from pinned framework versions, cited in a sources section, so the references don’t drift as frameworks update.

For anyone who needs to map AI risk to an existing compliance or governance program, this is the most immediately useful structural change in the document. A single reference appendix with version-controlled mappings to nine frameworks is considerably easier to maintain and cite than hunting through ten separate entries for the relevant links.

Practical takeaway: Don’t try to build a model that can’t be fooled

The 2026 OWASP Top 10 for LLM Applications is a more trustworthy and practical document than its predecessors, mostly because the process now has a check on itself. The community judgment that shaped every prior edition is still there and carries three-quarters of the weight, but now it’s being checked and tested against a record of what has actually gone wrong.

The gap between the two is where security blind spots live. Prompt injection is persistently top of mind because teams are aware of it and working hard on it. Misinformation is underrepresented in the vote because teams haven’t yet caught up with how dangerous a wrong answer in an agentic pipeline can be.

There’s no better way to end this post than with the authors’ own advice for building more secure LLM applications:

“Stop trying to build a model that cannot be fooled. Build the system around it, so that when the model is fooled – and it will be – nothing important breaks.”
– OWASP Top 10 for LLM Applications 2026

‍Read the full OWASP Top 10 for LLM Applications 2026