OWASP Top 10 for LLM Applications 2026

The OWASP Top 10 for LLM Applications 2026 is a community-driven reference for LLM security, developed by hundreds of contributors and published by the OWASP GenAI Security Project on 3 August 2026. It is not a formal standard: it is one of the most widely referenced community guides, and it maps its risk areas to NIST, MITRE ATLAS, CWE, and the OWASP Top 10 for Agentic Applications.

This entry does not reproduce the official item list. Ranking, identifiers and wording change between editions, and ATLAS does not maintain a competing summary: the official resource is the primary source for the current ten risks and their identifiers.

What changed in 2026

• The 2026 edition was published on 3 August 2026 and incorporates updated rankings and expanded threat coverage.
• Its methodology weighs expert judgement against a large body of real-world AI security incidents.
• It expands mappings to NIST, MITRE ATLAS, CWE and the OWASP Top 10 for Agentic Applications.

ATLAS does not assert item-level equivalence with any edition. The mapping below is expressed at the level of risk area and typed by the strength of the relationship.

Mapping to the ATLAS Risk Catalogue

OWASP risk area	ATLAS entry	Mapping type
Prompt Injection	Prompt Injection	exact
Sensitive Information Disclosure	Sensitive Data Disclosure	partial
Supply Chain	Agentic Supply Chain Compromise	partial
Data and Model Poisoning	Data and Model Poisoning	exact
Improper Output Handling	Improper Output Handling	exact
Excessive Agency	Excessive Agency	exact
System Prompt Leakage	System Prompt Leakage	partial
Vector and Embedding Weaknesses	Vector and Embedding Weaknesses	exact
Misinformation	Misinformation	related
Unbounded Consumption	Unbounded Consumption	exact
Overreliance	No direct ATLAS entry	related_to → Misinformation
Model Theft	No direct ATLAS entry	related_to → Sensitive Data Disclosure

Why two mappings are not equivalences

ATLAS explicitly avoids presenting false equivalence:

• Overreliance is not Misinformation. Overreliance is the acceptance of model output without verification; Misinformation is false or misleading content presented with apparent authority. They are related, not identical.
• Model Theft is not Sensitive Data Disclosure. Model theft affects the confidentiality of weights, architecture or IP. Sensitive Data Disclosure concerns information exposed through prompts, outputs, logs, retrieval or connected tools.

ATLAS connection

The OWASP LLM Top 10 describes the LLM application threat surface. ATLAS connects each mapped risk area to controls and evidence. Relevant controls include Input and Output Validation for AI Agent Components, Prompt and Output Logging, and Data Classification Before AI Use.

Primary source →