The OWASP GenAI Security Project has released the 2026 edition of its Top 10 for LLM Applications, marking the first time the list has incorporated real-world incident data in its ranking methodology. While previous iterations relied solely on expert consensus, the 2026 list weighted practitioner votes at 75% and integrated data from 6,639 incidents, sourced from public vulnerability databases and an AI-harm database, for the remaining 25%.
This new methodology led to several shifts in the rankings compared to the 2025 list. "Prompt Injection" maintained its position as the number one risk, despite a relatively low number of recorded incidents. OWASP attributes this to a "defense effect," suggesting that extensive efforts to mitigate prompt injection attacks prevent many successful incidents from appearing in public records, thus understating the actual risk.
Conversely, "Misinformation" saw a significant jump of two places, driven primarily by the incident data, which ranked it much higher than expert votes. OWASP explained that incorrect, incomplete, or misleading outputs from LLMs can appear believable to both humans and agents, leading to system-level failures. These failures can manifest as financial losses, security incidents, safety hazards, or operational disruptions, especially as model outputs increasingly drive tool calls, code generation, system state inference, action authorization, and agent coordination.
"Excessive Agency," which describes AI systems with too much autonomous power, climbed to third place, a position supported by both expert votes and incident data indicating that agentic deployments are a significant source of damage. "Unbounded Consumption" rose four places, reflecting practitioners' increased concern over resource and cost exhaustion. "Output Handling" fell from fifth to tenth place and had its scope broadened.
"System Prompt Leakage" was renamed and expanded to "Hidden Context Exposure." Additionally, several existing categories absorbed new, sharper risks. "Prompt Injection" now encompasses cross-modal attacks embedded in images or audio, while "Data and Model Poisoning" includes fine-tuning subversion.
A central theme of the 2026 list is a shift in focus from preventing models from being fooled to controlling the blast radius when they inevitably are. OWASP emphasizes building systems around LLMs so that critical functions remain intact even if the model itself is compromised.
The project also clarified the scope of the LLM Top 10, stating that it addresses risks associated with models as components within applications. Risks related to models acting as autonomous agents with tools, memory across sessions, and downstream consequences are now covered by the OWASP Agentic Top 10.
