Research · AI security · OWASP · LLM Top 10
OWASP Top 10 for LLM Applications 2026 vs 2025: what changed
OWASP reshuffled its AI Top 10 and the IDs changed meaning. LLM06 was Excessive Agency, now it's Unbounded Consumption. The full 2025 to 2026 crosswalk, what moved and three things to do this week.
Short answer
OWASP published the 2026 Top 10 for LLM Applications in August 2026 and reordered the list, so the IDs changed meaning: LLM06 was Excessive Agency in 2025 and is Unbounded Consumption in 2026. Always write the year with the ID (LLM06:2026), and re-map any risk register, policy or scanner rule that uses the old numbers.
OWASP’s GenAI Security Project has a new edition of the Top 10 for LLM Applications. The 2026 version was posted on OWASP’s site in August 2026 and formally announced on 1 September 2026. (OWASP resource page, announcement)
Most of the names are the same. The order isn’t. And that matters more than it sounds, because the IDs moved with the order.
LLM06:2025 was Excessive Agency. LLM06:2026 is Unbounded Consumption.
If your risk register, a policy, a pen test report or a scanner rule just says “LLM06”, nobody can tell which one you meant. So the first habit to pick up: always write the year. LLM03:2026, never LLM03.
The full crosswalk
| 2026 | Risk | 2025 | Move |
|---|---|---|---|
| LLM01:2026 | Prompt Injection | LLM01:2025 | Same |
| LLM02:2026 | Sensitive Information Disclosure | LLM02:2025 | Same |
| LLM03:2026 | Excessive Agency | LLM06:2025 | Up 3 |
| LLM04:2026 | Supply Chain | LLM03:2025 | Down 1 |
| LLM05:2026 | Data and Model Poisoning | LLM04:2025 | Down 1 |
| LLM06:2026 | Unbounded Consumption | LLM10:2025 | Up 4 |
| LLM07:2026 | Misinformation | LLM09:2025 | Up 2 |
| LLM08:2026 | Hidden Context Exposure | LLM07:2025 (System Prompt Leakage) | Renamed, down 1 |
| LLM09:2026 | Vector and Embedding Weaknesses | LLM08:2025 | Down 1 |
| LLM10:2026 | Improper Output Handling | LLM05:2025 | Down 5 |
Sources: the 2026 PDF and the 2025 list.
What actually changed
Excessive Agency went up to #3. Excessive agency means an AI system has more tools, permissions or freedom to act than the job needs, so one bad or manipulated output turns into a real action: a deleted record, a sent email, a payment. The 2026 PDF says it “climbed to third, the most consequential move on the list”. The announcement quotes Michael Bargury of Zenity saying this is “the risk where expert judgment and the record agree most clearly”. That matches what most of us are seeing: teams moved from chatbots to agents with real tokens.
Unbounded Consumption rose four places, #10 to #6. Plain meaning: nothing stops someone (or a runaway loop) from using your model as much as they like. The PDF describes it as uncontrolled inference that lets attackers exhaust resources, inflate costs or extract the model. Think of it as someone ordering 10,000 pizzas on your account. The damage is the bill, not the downtime.
System Prompt Leakage became Hidden Context Exposure (#8). The new name is wider. Per the PDF, hidden context “typically includes the system prompt, developer instructions, retrieved policy text”, plus “the schemas of tools and functions the application exposes to the model”. Two things are explicitly not in this entry: leaks of user or training data (that’s LLM02:2026, Sensitive Information Disclosure) and agent-specific problems like persistent memory, which OWASP puts in its separate Top 10 for Agentic Applications.
Improper Output Handling fell the furthest, #5 to #10. That’s OWASP’s wording too. It’s about model output being passed to a browser, shell, database or code runner without checks. A lower rank isn’t a pass. If your app renders model output as HTML or runs generated code, this is still XSS and injection with a new front door.
Misinformation moved up two, #9 to #7. Wrong but believable output that people or automated steps act on.
The OWASP team says the 2026 ranking was tested “against thousands of real-world incidents”, not just expert votes. (announcement)
Three things I’d do this week
- Fix your IDs. Search tickets, risk registers, policies, test reports, scanner rules and dashboards for bare
LLM0andLLM10. Add the year to each one using the table above. Do it now while you still remember which edition each one meant. - Audit what your agents can do (LLM03:2026). For each agent, list every tool and token it holds. Cut to least privilege, prefer short-lived credentials, and require a human approval for anything that writes, sends or deletes.
- Cap the spend (LLM06:2026). Per-user rate limits, a max tokens setting on every request, and budget alerts on your model provider account. If you can’t say what your worst-case daily bill is, that’s the gap.
One more: if you map findings to OWASP in a GRC tool or a scanner, check whether the vendor has updated to 2026 and which edition your existing findings are tagged with. Mixed editions in one report is how “LLM06” ends up meaning two things on the same page.
Sources
- OWASP GenAI Security Project, Top 10 for LLM Applications 2026, resource page (posted 3 Aug 2026): genai.owasp.org
- Top 10 for LLM Applications 2026 PDF: genai.owasp.org/download/56857. Note: the PDF cover still reads “Publication date to be set”.
- OWASP GenAI Security Project announcement, 1 Sep 2026: genai.owasp.org
- Top 10 for LLM Applications 2025: genai.owasp.org/llm-top-10