OWASP Top 10 for LLM Applications 2026

The OWASP Top 10 for LLM Applications 2026 is the community-driven reference for LLM security, developed by hundreds of contributors across more than 18 countries. It maps each vulnerability to CWE, MITRE ATLAS tactics, and NIST AI RMF controls, making it the most widely referenced mapping of LLM-specific security risks.

The ten risks at a glance

#	Risk	Core concern
LLM01	Prompt Injection	Untrusted input manipulates model behaviour, bypassing intended guardrails
LLM02	Insecure Output Handling	Unvalidated LLM output reaches downstream systems, enabling injection, code execution, or data exposure
LLM03	Training Data Poisoning	Compromised training or fine-tuning data introduces backdoors, bias, or degraded safety behaviour
LLM04	Model Denial of Service	Resource-exhaustion attacks degrade availability or inflate operational costs
LLM05	Supply Chain Vulnerabilities	Third-party models, datasets, or plugins introduce untrusted dependencies
LLM06	Sensitive Information Disclosure	Model outputs or logs leak personal data, credentials, or proprietary information
LLM07	Insecure Plugin Design	Plugins receive untrusted input with insufficient access control or input validation
LLM08	Excessive Agency	The LLM is granted authority to act beyond what its reliability, context, or supervision can justify
LLM09	Overreliance	Human operators or downstream systems accept LLM output without verification
LLM10	Model Theft	Unauthorised access, copying, or exfiltration of proprietary model weights or architecture

ATLAS connection

All ten OWASP LLM risks have corresponding entries in the ATLAS Risk Catalogue:

OWASP LLM	ATLAS Risk
LLM01 — Prompt Injection	Prompt Injection
LLM02 — Insecure Output Handling	Improper Output Handling
LLM03 — Training Data Poisoning	Data and Model Poisoning
LLM04 — Model Denial of Service	Unbounded Consumption
LLM05 — Supply Chain Vulnerabilities	Agentic Supply Chain Compromise
LLM06 — Sensitive Information Disclosure	Sensitive Data Disclosure
LLM07 — Insecure Plugin Design	Insecure Tool Invocation
LLM08 — Excessive Agency	Excessive Agency
LLM09 — Overreliance	Misinformation
LLM10 — Model Theft	Sensitive Data Disclosure

Additional ATLAS risks covering OWASP territory include System Prompt Leakage and Vector and Embedding Weaknesses, which appear in the 2025 edition and remain relevant to any LLM security programme.

Official website →