The Sec Guy
Open Menu

Notes · AI security · OWASP · LLM Top 10

OWASP Top 10 for LLM Applications 2026 vs 2025: what changed

OWASP reshuffled its AI Top 10 and the IDs changed meaning. LLM06 was Excessive Agency, now it's Unbounded Consumption. The full 2025 to 2026 crosswalk, what moved and three things to do this week.

21 October 2026 · 4 min read

OWASP’s GenAI Security Project has a new edition of the Top 10 for LLM Applications. The 2026 version was posted on OWASP’s site in August 2026 and formally announced on 1 September 2026. (OWASP resource page, announcement)

Most of the names are the same. The order isn’t. And that matters more than it sounds, because the IDs moved with the order.

LLM06:2025 was Excessive Agency. LLM06:2026 is Unbounded Consumption.

If your risk register, a policy, a pen test report or a scanner rule just says “LLM06”, nobody can tell which one you meant. So the first habit to pick up: always write the year. LLM03:2026, never LLM03.

The full crosswalk

2026Risk2025Move
LLM01:2026Prompt InjectionLLM01:2025Same
LLM02:2026Sensitive Information DisclosureLLM02:2025Same
LLM03:2026Excessive AgencyLLM06:2025Up 3
LLM04:2026Supply ChainLLM03:2025Down 1
LLM05:2026Data and Model PoisoningLLM04:2025Down 1
LLM06:2026Unbounded ConsumptionLLM10:2025Up 4
LLM07:2026MisinformationLLM09:2025Up 2
LLM08:2026Hidden Context ExposureLLM07:2025 (System Prompt Leakage)Renamed, down 1
LLM09:2026Vector and Embedding WeaknessesLLM08:2025Down 1
LLM10:2026Improper Output HandlingLLM05:2025Down 5

Sources: the 2026 PDF and the 2025 list.

What actually changed

Excessive Agency went up to #3. Excessive agency means an AI system has more tools, permissions or freedom to act than the job needs, so one bad or manipulated output turns into a real action: a deleted record, a sent email, a payment. The 2026 PDF says it “climbed to third, the most consequential move on the list”. The announcement quotes Michael Bargury of Zenity saying this is “the risk where expert judgment and the record agree most clearly”. That matches what most of us are seeing: teams moved from chatbots to agents with real tokens.

Unbounded Consumption rose four places, #10 to #6. Plain meaning: nothing stops someone (or a runaway loop) from using your model as much as they like. The PDF describes it as uncontrolled inference that lets attackers exhaust resources, inflate costs or extract the model. Think of it as someone ordering 10,000 pizzas on your account. The damage is the bill, not the downtime.

System Prompt Leakage became Hidden Context Exposure (#8). The new name is wider. Per the PDF, hidden context “typically includes the system prompt, developer instructions, retrieved policy text”, plus “the schemas of tools and functions the application exposes to the model”. Two things are explicitly not in this entry: leaks of user or training data (that’s LLM02:2026, Sensitive Information Disclosure) and agent-specific problems like persistent memory, which OWASP puts in its separate Top 10 for Agentic Applications.

Improper Output Handling fell the furthest, #5 to #10. That’s OWASP’s wording too. It’s about model output being passed to a browser, shell, database or code runner without checks. A lower rank isn’t a pass. If your app renders model output as HTML or runs generated code, this is still XSS and injection with a new front door.

Misinformation moved up two, #9 to #7. Wrong but believable output that people or automated steps act on.

The OWASP team says the 2026 ranking was tested “against thousands of real-world incidents”, not just expert votes. (announcement)

Three things I’d do this week

  1. Fix your IDs. Search tickets, risk registers, policies, test reports, scanner rules and dashboards for bare LLM0 and LLM10. Add the year to each one using the table above. Do it now while you still remember which edition each one meant.
  2. Audit what your agents can do (LLM03:2026). For each agent, list every tool and token it holds. Cut to least privilege, prefer short-lived credentials, and require a human approval for anything that writes, sends or deletes.
  3. Cap the spend (LLM06:2026). Per-user rate limits, a max tokens setting on every request, and budget alerts on your model provider account. If you can’t say what your worst-case daily bill is, that’s the gap.

One more: if you map findings to OWASP in a GRC tool or a scanner, check whether the vendor has updated to 2026 and which edition your existing findings are tagged with. Mixed editions in one report is how “LLM06” ends up meaning two things on the same page.

Sources