The OWASP Top 10 for LLM and Agentic AI is a pair of community-built security standards from the OWASP GenAI Security Project that rank the most critical risks in AI systems. The OWASP Top 10 for LLM Applications covers risks in systems that generate content, and the OWASP Top 10 for Agentic Applications covers risks in systems that take autonomous action. Security teams use them to test AI deployments, define controls, and document AI risk for auditors and boards.
They are two separate lists, published on different cycles, that are designed to be used together. The LLM Top 10 reached its 2026 edition in August 2026. The Agentic Top 10 published its first edition, dated 2026, on December 9, 2025.
The OWASP Top 10 for LLM Applications 2026 is a ranked list of the ten most critical security risks in applications built on large language models. It was released in August 2026 and replaces the 2025 edition.
|
Rank |
2026 entry |
2025 rank |
What it means |
|---|---|---|---|
|
LLM01:2026 |
Prompt Injection |
1 |
Untrusted input alters the model's instructions, directly or through content it retrieves |
|
LLM02:2026 |
Sensitive Information Disclosure |
2 |
The model reveals PII, credentials, or proprietary data through its outputs |
|
LLM03:2026 |
Excessive Agency |
6 |
The model holds more permission, autonomy, or functionality than the task requires |
|
LLM04:2026 |
Supply Chain |
3 |
Compromised models, datasets, plugins, or dependencies enter the stack |
|
LLM05:2026 |
Data and Model Poisoning |
4 |
Manipulated pre-training, fine-tuning, or embedding data corrupts model behavior |
|
LLM06:2026 |
Unbounded Consumption |
10 |
Uncontrolled inference drives cost, denial of service, or model extraction |
|
LLM07:2026 |
Misinformation |
9 |
Fabricated or wrong output is acted on as fact by downstream systems or people |
|
LLM08:2026 |
Hidden Context Exposure |
7 (renamed) |
System prompts, tool definitions, and fine-tuning artifacts leak and enable reconnaissance |
|
LLM09:2026 |
Vector and Embedding Weaknesses |
8 |
RAG pipelines leak across tenants or ingest poisoned documents |
|
LLM10:2026 |
Improper Output Handling |
5 |
Model output reaches a downstream interpreter without validation, producing XSS, SSRF, or command injection |
The 2026 edition changed the method, not just the ranking. Earlier editions ranked risks by expert consensus. The 2026 list weights a community vote at 75% and real incident data at 25%, drawn from a corpus of 7,714 LLM-related security incidents, 6,639 of which had enough detail to classify.
The reordering follows the evidence:
The OWASP Top 10 for Agentic Applications 2026 is a ranked list of the ten most critical security risks in AI systems that plan, use tools, retain memory, and act without a human in each step. The OWASP Agentic Security Initiative published it on December 9, 2025, with more than 100 contributors and a review board from NIST, Cisco, Microsoft, and AWS. Entries are numbered ASI01 through ASI10.
|
ID |
Risk |
What it means |
|---|---|---|
|
ASI01 |
Agent Goal Hijack |
An attacker redirects the agent's objective through content the agent reads |
|
ASI02 |
Tool Misuse and Exploitation |
Legitimate tool access is bent toward illegitimate outcomes via deceptive input or poisoned tool metadata |
|
ASI03 |
Identity and Privilege Abuse |
Broad, long-lived agent credentials and delegation chains become escalation paths |
|
ASI04 |
Agentic Supply Chain Vulnerabilities |
Unvetted frameworks, connectors, MCP servers, and runtime tool discovery introduce untrusted code |
|
ASI05 |
Unexpected Code Execution (RCE) |
Natural language becomes running code outside intended boundaries through sandbox escape or eval-style APIs |
|
ASI06 |
Memory and Context Poisoning |
False information is planted in what the agent will later treat as its own knowledge |
|
ASI07 |
Insecure Inter-Agent Communication |
Agent-to-agent messages are spoofed or replayed without authentication or integrity checks |
|
ASI08 |
Cascading Failures |
One compromised decision propagates across connected agents and automations |
|
ASI09 |
Human-Agent Trust Exploitation |
The agent controls what a human sees at the approval point, and automation bias does the rest |
|
ASI10 |
Rogue Agents |
An agent operates outside policy while appearing legitimate, persisting across sessions |
The LLM Top 10 governs what a model says. The Agentic Top 10 governs what a system does.
That distinction has practical consequences for every control you write:
|
Dimension |
LLM Top 10 (2026) |
Agentic Top 10 (2026) |
|---|---|---|
|
Unit of risk |
A single model response |
A multi-step workflow with memory and tools |
|
Blast radius |
Output consumed by a person or app |
Actions executed against production systems |
|
Time horizon |
Bounded by the session |
Persists through stored memory and long-lived credentials |
|
Primary controls |
Input validation, output handling, data governance |
Identity, least privilege, tool authorization, containment |
|
Detection surface |
Prompt and response logs |
Agent traces, tool calls, inter-agent messages |
The Agentic Top 10 extends the LLM Top 10 rather than replacing it. Each ASI entry cross-references the corresponding LLM entries and the underlying OWASP Agentic AI Threats and Mitigations taxonomy. Prompt injection (LLM01) and excessive agency (LLM03) appear throughout the agentic list because autonomy turns a model-layer weakness into an operational one.
The rule of thumb: if the system only generates, the LLM Top 10 is sufficient. The moment it can call a tool, write to a system, or hand work to another agent, both lists apply.
Because it gives AI risk a vocabulary that survives contact with an auditor, a regulator, and a board.
Before these lists, AI risk conversations ran on adjectives. A security leader could describe an AI deployment as "reviewed" or "hardened" without a shared definition of either. OWASP replaced that with named, numbered, testable risk categories — the same shift the original OWASP Top 10 produced for web applications two decades ago.
Three concrete uses:
Testing scope. Red teams and AI security testing tools now scope engagements directly against ASI and LLM identifiers, making results comparable across quarters and vendors.
Control definition. Each entry maps to specific technical controls — tool authorization for ASI02, credential scoping and delegation limits for ASI03, retrieval provenance for LLM09. That mapping is what turns a risk list into an engineering backlog.
Regulatory evidence. Neither list is a regulation. But NIST AI RMF, ISO/IEC 42001, and the EU AI Act all require documented identification and treatment of AI risks without naming them. OWASP supplies the named risks those obligations assume you have. Organizations that assess AI systems against both Top 10s produce most of the evidence those frameworks ask for as a byproduct; the same way a well-run control program produces audit evidence without a separate audit workstream.
Applying the lists well means treating them as an inventory problem before a testing problem.
Start with an inventory of AI systems and their agency level. For each system, record what it can read, what it can write, which tools it can invoke, and whether it retains memory between sessions. Systems that can only generate map to the LLM list. Systems that can act map to both. Most enterprises discover more of the second kind than they expected.
Assign owners and controls per entry, not per list. ASI03 belongs to identity engineering. LLM09 belongs to whoever owns the RAG pipeline. Treating "AI security" as one owner's problem is how these lists become a slide instead of a program.
Instrument the agent trace, not just the prompt. ASI06, ASI07, ASI08, and ASI10 are only detectable if you log tool calls, memory writes, and inter-agent messages with the same rigor you apply to authentication events. Prompt logs alone will not surface a poisoned memory or a rogue agent.
Quantify the exposure. A ranked list tells you what can go wrong; it does not tell you what to fund first. Connecting each risk to the systems it touches, the business processes those systems run, and the probable financial loss is what turns an OWASP assessment into an investment decision your CFO can act on.
Re-run on release. The 2026 LLM revision moved four entries by three or more positions. An assessment mapped to the 2025 list is already describing a different threat model than the one your systems face.
It refers to two ranked security standards from the OWASP GenAI Security Project: the OWASP Top 10 for LLM Applications, which covers risks in systems that generate content, and the OWASP Top 10 for Agentic Applications, which covers risks in systems that act autonomously. Both editions are dated 2026.
No. They are complementary and maintained in parallel. The Agentic Top 10 extends the LLM list to cover autonomy, tool use, memory, and multi-agent workflows, and each agentic entry cross-references the LLM entries it builds on. Any system that both generates and acts falls under both.
Prompt Injection (LLM01:2026). It held the top position from the previous edition, though the two inputs to the ranking disagreed sharply: practitioners voted it first, while incident data alone would have dropped it out of the top ten. OWASP attributes the low incident count to years of defensive investment rather than a shrinking attack surface, which still sits everywhere a model reads untrusted input.
ASI01 is Agent Goal Hijack: an attacker redirects an agent's objective or decision path through content the agent reads, causing it to pursue the attacker's goal while appearing to operate normally.
NIST AI RMF and ISO/IEC 42001 define how to govern AI risk. The OWASP lists define which risks to govern. Enterprises typically use OWASP entries as the technical risk register underneath a NIST or ISO management system, so a single assessment satisfies the identification and treatment requirements in both.
Yes. ASI04 (Agentic Supply Chain Vulnerabilities) and LLM04 (Supply Chain) cover that case, including unvetted frameworks, connectors, MCP servers, and runtime tool discovery in purchased systems. Vendor AI assessments increasingly reference these identifiers directly.
The LLM Top 10 has been updated roughly annually, moving from the 2023/24 edition to 2025 and then to 2026. The Agentic Top 10 published its first edition in December 2025 alongside a synchronized 1.1 update to the OWASP Agentic AI Threats and Mitigations taxonomy.
See Also