OWASP LLM Top 10 2026: What Changed for App Builders

Which entries moved, which one was renamed, and the settings in your own app that each change points at. Checked October 24, 2026.

Timothy Lindblom

Founder, Newly

October 24, 2026|9 min read

Published October 24, 2026Last updated October 24, 2026

OWASP published the 2026 Top 10 for LLM Applications in August 2026 and announced it on September 1. Excessive Agency rose from sixth to third, Unbounded Consumption from tenth to sixth, and Improper Output Handling fell from fifth to tenth. System Prompt Leakage became Hidden Context Exposure. Treat the list as questions to ask about your own app.

What are the key facts, and which release date is right?

Item	What the source says
Edition	OWASP Top 10 for LLM Applications 2026, entries LLM01:2026 to LLM10:2026
Announcement	September 1, 2026, on the OWASP GenAI announcement
Resource page	Publication date August 3, 2026 on the 2026 resource page
Repository	Release date August 4, 2026 in the GitHub README
Method	A corpus of 7,714 real incidents tested against practitioner votes, with the vote carrying three quarters of the weight, per the preface
Previous edition	The 2025 edition, LLM01:2025 to LLM10:2025

The three dates do not conflict. The list went up in early August and the announcement came a month later. Cite the edition as 2026 and, if you need a date, say which page you took it from.

What changed in the ranking since 2025?

2026	Entry	2025	Change
LLM01	Prompt Injection	LLM01	Same place
LLM02	Sensitive Information Disclosure	LLM02	Same place
LLM03	Excessive Agency	LLM06	Up three places
LLM04	Supply Chain	LLM03	Down one
LLM05	Data and Model Poisoning	LLM04	Down one
LLM06	Unbounded Consumption	LLM10	Up four places
LLM07	Misinformation	LLM09	Up two places
LLM08	Hidden Context Exposure	LLM07	Renamed from System Prompt Leakage, broader scope
LLM09	Vector and Embedding Weaknesses	LLM08	Down one
LLM10	Improper Output Handling	LLM05	Down five places

No entry was dropped. OWASP's preface says several entries absorbed neighbouring risks: Prompt Injection now covers cross-modal input, Supply Chain covers promoted model artifacts, Data and Model Poisoning covers fine-tuning subversion, and Improper Output Handling spans insecure code that assistants generate at scale.

A lower rank does not mean a smaller risk. Improper Output Handling fell because other entries were voted higher. The entry still lists browsers, databases, shells, email templates and logs as places where unchecked model output does damage.

Where does each entry sit in an AI chat feature?

Most apps built with an AI builder have one shape: a user types or uploads something, your server sends it to a model with a system prompt and a list of tools, and the reply is shown in the app. Each of the changes that matter most maps to one step of that path.

Excessive Agency moved to third

The LLM03 entry names three causes: excessive functionality, excessive permissions and excessive autonomy. In an app, that is a tool that can do more than the feature needs, a tool that runs with a broader key than the signed-in user holds, or a tool that sends, deletes or pays without asking. The entry recommends running actions in the user's own context and requiring approval for consequential ones.

System Prompt Leakage became Hidden Context Exposure

LLM08 covers anything the model sees that the user should not: the system prompt, developer instructions, retrieved policy documents and tool schemas. Its first mitigation is to keep credentials and sensitive configuration out of that context entirely. If a key sits in a prompt, rotate it, as in our guide to leaked AI provider keys.

Unbounded Consumption rose to sixth

LLM06 describes denial of wallet: abusing a pay-per-use AI service until the bill is unsustainable. It lists token-aware rate limits and hard spending caps first. AI inside a Newly app uses credits, so an endpoint anyone can call lets a stranger spend them.

Improper Output Handling fell to tenth

LLM10 includes disabling auto-rendering of Markdown images and applying a strict Content Security Policy. Our page on the chat image leak and its CSP fix covers that case in detail.

Prompt Injection stays first, with a new framing

The LLM01 entry adds a rule of thumb: limit how many of three things one feature has at once, which are untrusted input, sensitive data and the ability to change state. A feature with all three is where an injected instruction can do the most.

What should I check in my own app?

Entry	Where to look	What the result means
LLM01	Every feature where the model reads uploads, web pages or email, and which tools that feature can call	All three of untrusted input, private data and a state change in one feature: detected. Split it up
LLM08 and LLM02	The system prompt, tool definitions and any policy documents you feed the model, plus request logs	A key, internal address or customer name in any of them: detected. Remove it and rotate the key
LLM03	The tool list, and the key or role each tool uses on the server	A tool using a service key that bypasses user rules: detected. Run it as the user
LLM06	The provider dashboard for a spending cap, and the app for a per-user message limit	No cap and no limit: detected. A cap you have not read yourself: unknown
LLM10	How replies are rendered, and whether any reply reaches a query or a command	Remote images load from reply text: detected. Turn them off
LLM09	Any document search: is the tenant filter inside the query or applied after results come back	Filter applied after: detected. The entry says to scope tenants inside the index query
LLM04	Packages, model files and agent tooling your build pulls in	Unpinned or unreviewed: unknown. See AI tooling supply chain attacks

Keys in the app itself

Hidden context is one place a key can leak. The app bundle is another. Expo's documentation says EXPO_PUBLIC_ variables are visible in plain text in the compiled app, so an AI provider key belongs on a server. For a Supabase backend, the docs say to enable row level security on every table in an exposed schema.

For the broader first-pass check of an AI-built app, start with the 15-minute check. For a chat feature on a website, use the chatbot self-test.

Where do you stand?

Everything starts as unknown, because an unchecked item is unknown. Move an item to confirmed only when you hold the evidence listed under it.

Your OWASP 2026 check

Detected: You found the problem.
Unknown: Not checked yet, or the check could not tell.
Confirmed by owner evidence: You checked and kept the proof.

1. No single feature lets the model read text from strangers, reach private data and change something, all at once.
Evidence: a list of every text source the model reads and the tools each feature can call.
2. The system prompt, tool list and retrieved policy documents hold no keys, internal addresses or private names.
Evidence: the system prompt and tool definitions, with a search for key-shaped strings that found nothing.
3. Each tool runs with the signed-in user's permission, and tools that send, delete or pay ask the user first.
Evidence: the tool list with the permission each one runs under and the confirmation step.
4. A spending cap exists at the AI provider and a per-user limit exists in the app.
Evidence: a screenshot of the cap and the per-user limit setting.
5. Model replies are rendered with remote images turned off and are never passed to a database query or a command.
Evidence: the rendering setting and the code path that handles replies.
6. If the app searches documents for the model, the tenant filter is applied inside the search query. Otherwise the app has no retrieval.
Evidence: the search query showing the filter, or a note that none exists.

0 detected6 unknown0 confirmed by owner evidence

Your answers stay in this browser tab. Nothing is saved or sent.

What does the list not cover, and what can a scan see?

The LLM list is about the model and the app around it. The 2026 Supply Chain entry says MCP servers and tool registries fall under OWASP's separate Top 10 for Agentic Applications, published December 9, 2025. If your app connects to tool servers, read the MCP authorization checklist and the guide to exposed MCP servers.

Most entries describe decisions inside your app, so no outside scan answers them. A scan reads what a live site serves. It can match detected software versions to known vulnerabilities and flag keys in shipped bundles, open services and missing browser protections. That helps with the exposure side of the list. The rest stays unknown until you check it. The hub at newly.app/security collects the other checks.

Frequently asked questions

Which date is the OWASP LLM Top 10 2026 release date?

It depends on the page. OWASP's announcement is dated September 1, 2026. The 2026 resource page on genai.owasp.org shows August 3, 2026, and the GitHub repository lists a release date of August 4, 2026. At our check on October 24, 2026, the list itself was already public in August and the announcement came later.

Is System Prompt Leakage gone from the 2026 list?

The name is gone and the idea is not. OWASP's preface says what used to be System Prompt Leakage is now Hidden Context Exposure, a broader entry. It covers the system prompt, developer instructions, retrieved policy documents and tool schemas. The 2026 Sensitive Information Disclosure entry also keeps system prompt hygiene as a control.

Why did Excessive Agency move up to third place?

OWASP's preface calls it the most consequential move on the list. The entry describes three causes: tools that do more than needed, tools with more permission than needed, and actions taken without a person approving them. Apps that let a model call functions are where this shows up.

Does my app need to follow the OWASP list?

No law or app store requires it. The list is a community guide to the most critical risks for apps built on large language models. It is useful as a set of questions to ask about your own app, and your evidence is how you answer those questions.

Does the LLM Top 10 cover MCP servers and agents?

Only in part. The 2026 Supply Chain entry says MCP servers and tool registries are covered under OWASP's separate agentic standards. That is the Top 10 for Agentic Applications, published December 9, 2025, with entries ASI01 to ASI10.

Can a scan tell me whether my app meets the list?

No. A scan from outside reads what a live site serves. Most of these entries are decisions inside your app, such as what the system prompt holds and what a tool can do. The scan can show some exposure signals. The rest stays unknown until you check it and keep the evidence.

Sources

All OWASP pages and the Expo and Supabase docs were read on October 24, 2026.

OWASP GenAI Security Project unveils 2026 Top 10 for LLM Applications (September 1, 2026), OWASP GenAI Security Project
OWASP GenAI LLM Top 10 2026 (resource page), OWASP GenAI Security Project
OWASP Top 10 for LLM Applications 2026, repository README, GenAI-Security-Project on GitHub
LLM00 Preface: 2025 to 2026 changes and method, GenAI-Security-Project on GitHub
LLM01:2026 Prompt Injection, GenAI-Security-Project on GitHub
LLM02:2026 Sensitive Information Disclosure, GenAI-Security-Project on GitHub
LLM03:2026 Excessive Agency, GenAI-Security-Project on GitHub
LLM04:2026 Supply Chain, GenAI-Security-Project on GitHub
LLM06:2026 Unbounded Consumption, GenAI-Security-Project on GitHub
LLM08:2026 Hidden Context Exposure, GenAI-Security-Project on GitHub
LLM09:2026 Vector and Embedding Weaknesses, GenAI-Security-Project on GitHub
LLM10:2026 Improper Output Handling, GenAI-Security-Project on GitHub
OWASP Top 10 for LLMs, 2025 edition, OWASP GenAI Security Project
OWASP Top 10 for Agentic Applications (December 9, 2025), OWASP GenAI Security Project
Environment variables in Expo, Expo docs
Row Level Security, Supabase docs