LLM Security — Which of the Top Ten Risks Are Actually Yours (2026)

Quick answer: LLM security covers the ways an application built on a language model can be made to fail on purpose. The field's reference list is the OWASP Top 10 for LLM Applications, and the 2026 edition changed how the list is built: for the first time the practitioner vote was weighed against a classified corpus of 6,639 usable incidents drawn from 7,714 collected, at a stated three-to-one ratio in the vote's favor. Read the result as a business renting a chatbot rather than as a security team building one, and a line falls across it. By our reading four of the ten risks are configuration decisions you make inside a product you already pay for, three are shared, and three sit with a supplier. The four that are yours are the ones a vendor security page is not written to answer.

The 2026 list is the first one with evidence behind it

Every previous edition of the OWASP list was a vote. Hundreds of practitioners ranked what worried them, and the ranking was the product. That is a reasonable way to build a consensus document and it is also, as the project now says plainly, a record of belief rather than of harm.

The 2026 release changed that. The project assembled a corpus of 7,714 real incidents from public vulnerability databases and an AI-harm database, built classifiers to read them, and sorted the 6,639 that carried enough detail. Then it compared the two rankings. The weighting is stated rather than implied: "The community vote carries three-quarters of the weight. The incident data covers the remaining quarter."

The interesting part is where the two disagreed. Prompt injection is ranked first by practitioners and, on the raw incident record, "falls out of the top 10 entirely." OWASP reads that not as an overestimate but as a defense effect: "Teams fight injection hard, so fewer clean exploits reach a public database." Misinformation ran the other way. Voters put it near the bottom, the incident record put it near the top, and the published list, in OWASP's words, still "seats Misinformation in the middle": seventh of ten, well above where the vote alone would have left it. OWASP does not publish the vote-only ranking, so we cannot tell you how many places the evidence moved it.

For a buyer, that second one is the sentence worth carrying. The failure your suppliers talk about least is the one the incident record ranks far above the vote, and on a support bot it does not look like a security incident at all. It looks like a confident wrong answer. Our entry on AI hallucination covers the mechanism; what the 2026 data adds is that the consequences are showing up in the same databases as the exploits.

What moved, and in which direction

Two of those movements are worth a sentence each. Excessive Agency climbing to third is the one OWASP itself calls the most consequential move on the list, "because the vote and the record agree that agentic deployments are where the damage is landing." Improper Output Handling falling five places is the mirror image. The fall is OWASP's; the explanation we would offer for it is ours, and it is that the classic developer-side risk of piping model output into something that executes it recedes as more organizations consume models through finished products rather than through code.

Both movements point the same way. The list is drifting from problems that belong to whoever writes the application toward problems that belong to whoever configures the deployment. That is a drift toward the buyer.

The line through the middle: what a renting operator actually controls

Here is the analysis this entry exists for, and it is our reading rather than OWASP's.

The rule we applied: a risk is yours if the primary control is a configuration or content decision you can make inside the product you already rent, without your vendor's cooperation. Everything else is shared or upstream. Applied to the ten, it splits four, three and three.

Yours — four of ten. Sensitive Information Disclosure (LLM02) is decided by what you loaded into the bot's knowledge base and what you piped into its context; our guide to PII handling is the operational version. Excessive Agency (LLM03) is decided by which tools you connected and what permissions they carry. OWASP's own remedy is to "[i]mplement authorization in logic rather than relying on an LLM to decide if an action is allowed or not," which is a statement about your integration, not about your model. Misinformation (LLM07) is decided by grounding, by whether the bot cites, and by when it escalates rather than guesses; see our confidence policy guide. Hidden Context Exposure (LLM08) is decided by what you wrote into the system prompt in the first place, which is why the 2026 rename matters: the risk is no longer framed as the prompt leaking but as hidden operational context, such as policy logic, tool names and trust boundaries, being reconstructed by someone who never sees the prompt. This one sits closest to the line, and we would concede the edge: how hard the model resists extraction is not yours, only the decision about what to put within reach is.

Shared — three of ten. Prompt Injection (LLM01), where the model's robustness is upstream but the choice of which untrusted inputs the bot reads is yours; our prompt injection entry covers why no filter closes it. Unbounded Consumption (LLM06), where the vendor sets the ceiling and you set the budget, the rate limit where the product exposes one, and whether an unauthenticated widget can burn your quota. Vector and Embedding Weaknesses (LLM09), which is your problem if you built the store and your vendor's if you use their managed one; see vector database for the distinction that decides which.

Upstream — three of ten. Supply Chain (LLM04) and Data and Model Poisoning (LLM05) concern artifacts and training your supplier controls, with one operator-side exception each: every third-party connector or Model Context Protocol server you install is a supply-chain decision you made. Improper Output Handling (LLM10) belongs to whoever renders the output, which on a rented chat widget is the vendor — and returns to you the moment you build your own front end.

The uncomfortable observation is what the first bucket has in common. None of the four requires a purchase from your vendor, though grounding and human handoff may sit behind the plan tier you are already on; what they mostly cost is attention. And in the vendor security pages we have read while researching this catalog, the argument is about the third bucket: certifications, encryption, subprocessors, model providers. We have not audited them systematically and publish no count, so read that as an impression rather than a measurement. Those assurances are worth having, and they answer questions somebody else had to ask.

Where it breaks

Buying assurance for the third bucket and calling it security. A compliance badge is evidence about your supplier's practices. It says nothing about whether your bot can issue a refund without a permission check.

Reading the list as ten equal items. OWASP does not present it that way, and the 2026 edition says plainly which entries the vote and the incident record disagreed about, and in which direction. "Work all ten, start at the top" is the project's own instruction; working it top-down within the bucket you control is ours.

Treating a guardrail as coverage. AI guardrails sit around the model and narrow consequences. They do not move a risk from the upstream bucket into yours, and a feature page that implies otherwise is describing containment as prevention — the same conflation our LLM jailbreak entry works through in detail.

Missing the boundary OWASP now draws. The 2026 preface says this list owns the risk "when the model is a component inside your application," and that once the model becomes an actor "with tools it can call, memory it carries between sessions, and consequences it sets in motion downstream," the risk moves to the OWASP Agentic Top 10. Many products sold to small businesses as AI chatbots in 2026 have crossed that line. If yours calls tools, the Top 10 alone is no longer the whole map, a point our AI agent entry approaches from the product side.

Never testing any of it. A list you have read is not a control. The structured, scoped version of finding out is in our AI red teaming guide, and the cheap first pass is our free prompt-injection tester.

What our own reviews say about this

We searched all fifteen published platform reviews on 16 August 2026, case-insensitively, for the string owasp. The count is zero. Not one names the framework, in any context, including as a vendor claim we declined to verify.

That is a claim about naming, and it would be dishonest to inflate it into a claim that no security question was asked. The same fifteen files mention SOC 2 in eleven of them and GDPR in eleven, and guardrail in seven. Security questions were asked, repeatedly. What is striking is where they cluster: certifications, data protection and vendor features, which is the third bucket and the edge of the second. The first-bucket questions are the ones that are missing. rate limit returns zero across all fifteen.

So the gap is specific and it is ours. Whether a platform enforces tool authorization outside the model, whether it logs a blocked action separately from a model refusal, and whether it exposes an operator-settable rate limit at all are three questions a normal trial account could answer, and fifteen hands-on sessions did not put any of them. They are on the list for the next review-refresh pass. Until they are answered, this entry makes no comparative security claim about any platform in our catalog.

Related terms

• Prompt injection — LLM01, the top entry, and why the defense is containment rather than filtering.
• LLM jailbreak — where the two standards bodies file it differently, and why prevention is upstream.
• AI guardrails — the controls that sit around the model, and the five places one can live.
• System prompt — the instruction layer behind LLM08, and its limits.
• AI agent — the deployment shape that pushes you past this list and into the agentic one.
• Large language model — the component the whole list is about.

FAQ

What is LLM security?

It is the practice of protecting an application built on a large language model against deliberate failure — covering the model, the data it reads, the instructions it carries and the actions it is allowed to take. It differs from model safety, which concerns what the model itself will say, and from conventional application security, which assumes the component in the middle is deterministic. Its working reference is the OWASP Top 10 for LLM Applications.

What is the OWASP LLM Top 10 for 2026?

In order: Prompt Injection, Sensitive Information Disclosure, Excessive Agency, Supply Chain, Data and Model Poisoning, Unbounded Consumption, Misinformation, Hidden Context Exposure, Vector and Embedding Weaknesses, and Improper Output Handling. The edition was published on 4 August 2026 per the project repository, and is the first to weigh the practitioner vote against a classified corpus of real incidents, at a stated three-to-one ratio in favor of the vote.

What changed between the 2025 and 2026 lists?

The order moved more than usual. Excessive Agency rose from sixth to third, Unbounded Consumption from tenth to sixth, and Misinformation from ninth to seventh, while Improper Output Handling fell from fifth to tenth. System Prompt Leakage was renamed and broadened into Hidden Context Exposure, slipping one place from seventh to eighth in the process. Several entries also absorbed newer risks rather than spawning new categories: prompt injection now covers cross-modal attacks hidden in images or audio, and data and model poisoning now covers fine-tuning subversion.

Which of these risks can a small business actually do something about?

By our reading, four: sensitive information disclosure, excessive agency, misinformation and hidden context exposure. All four are decided by what you load, what you connect, what you write in the system prompt and when you escalate to a person. Three more are shared with your vendor and three sit upstream, where your only lever is what you ask before you sign.

Is a SOC 2 report evidence that a chatbot is secure against these risks?

It is evidence about a supplier's control environment, which is real and worth having, and it is not evidence about your configuration. A platform with impeccable certifications will still let you connect a tool with write access and no permission check, because that is your decision to make. The two questions are about different buckets.

Does this list still apply if my chatbot uses tools?

Partly, and OWASP now says so directly. The 2026 preface draws a boundary: this list owns the risk while the model is a component inside your application, and once it becomes an actor with tools, persistent memory and downstream consequences, the risk moves to the OWASP Agentic Top 10. Read this list for the model-as-component failures and pair it with the agentic one if your bot acts.

Where should a small team start?

With the four in the first bucket, because none of them requires buying anything new from your vendor, though grounding and handoff may sit behind the tier you are already on. Audit what is actually in the knowledge base, list every tool the bot can call and what each one is authorized to do, decide what the bot says when it does not know, and re-read the system prompt as though an attacker had a copy. Our chatbot security checklist is the pre-launch version of that pass.

Sources

• OWASP GenAI Security Project. OWASP Top 10 for LLM Applications 2026, canonical published release — the ten entry titles and their order, read on 16 August 2026 from the release's published file listing: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Excessive Agency, LLM04 Supply Chain, LLM05 Data and Model Poisoning, LLM06 Unbounded Consumption, LLM07 Misinformation, LLM08 Hidden Context Exposure, LLM09 Vector and Embedding Weaknesses, LLM10 Improper Output Handling. The release is dated 4 August 2026 in the project's repository and 3 August 2026 on the project's own resource page; we note the discrepancy rather than resolving it. github.com/GenAI-Security-Project
• OWASP GenAI Security Project. Letter from the Project Leads, the 2026 release preface, read in full on 16 August 2026 — the source of every methodology figure and quotation on this page: the corpus of "7,714 real incidents from public vulnerability databases and an AI-harm database," the statement that the project "built classifiers that read them," and the "6,639 that carried enough detail to sort"; the weighting statement, "The community vote carries three-quarters of the weight. The incident data covers the remaining quarter"; the finding that ranked by the raw incident record prompt injection "falls out of the top 10 entirely," that "That gap is a defense effect," and the explanation, "Teams fight injection hard, so fewer clean exploits reach a public database"; the Misinformation gap, "the widest gap in the direction that actually hurts," and the seating statement, "The list still seats Misinformation in the middle"; the instruction "Work all ten, start at the top"; the rank movements, including Excessive Agency climbing to third as "the most consequential move on the list, because the vote and the record agree that agentic deployments are where the damage is landing," Unbounded Consumption rising four places, and Improper Output Handling falling "from fifth to tenth"; the rename of System Prompt Leakage to Hidden Context Exposure; the absorbed risks, including cross-modal prompt injection and fine-tuning subversion; and the boundary statement that the list owns the risk "when the model is a component inside your application" while an actor "with tools it can call, memory it carries between sessions, and consequences it sets in motion downstream" moves to the OWASP Agentic Top 10. The document carries no dateline of its own; the release date above is taken from the repository and the project resource page. raw.githubusercontent.com
• OWASP GenAI Security Project. LLM03:2026 Excessive Agency, canonical 2026 source — the mitigation quoted in the ownership section, "Implement authorization in logic rather than relying on an LLM to decide if an action is allowed or not," together with its complete-mediation requirement that requests to downstream systems be validated "by the tool, by an independent pre-execution policy decision point between the tool and the downstream system, or by the downstream system itself." Read 16 August 2026. github.com/GenAI-Security-Project
• OWASP GenAI Security Project. LLM08:2026 Hidden Context Exposure, canonical 2026 source — the definition underlying this entry's description of the rename: "Hidden Context Exposure is the unauthorized extraction, inference, or reconstruction of hidden, non-user-facing system instructions or operational context placed in a model's context," which becomes security-relevant when that context "contains or reveals secrets, policy logic, tools, trust boundaries, workflow criteria, proprietary behavior, or other sensitive implementation details." Read 16 August 2026. github.com/GenAI-Security-Project
• OWASP GenAI Security Project. LLM Top 10 archive — the 2025 edition order used for the rank-movement table: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation, LLM10 Unbounded Consumption. The page carries no explicit release or last-modified date, which we state rather than infer. Read 16 August 2026. genai.owasp.org
• Chatbotscape platform reviews, all fifteen published reviews, searched 16 August 2026 — the catalog claims in this entry. Method: case-insensitive searches across the fifteen *-review.md files in sample-reviews/, excluding *.poc-notes.md, *.backup.md and files prefixed with an underscore. owasp returns zero matches in every one of the fifteen, and rate limit likewise returns zero in every one. For contrast, soc 2 matches in eleven of the fifteen files, gdpr in eleven, and guardrail in seven. The owasp search widened to our glossary/ and academy/ directories, restricted to *.md, excluding this entry and excluding editor artifacts without a .md extension, returns six entries, first published between 17 July and 16 August 2026. Both the patterns and the counts are published so the searches can be reproduced.
• Ahrefs Keywords Explorer, US and volume-by-country, queried 16 August 2026 — the search-demand and parent-topic figures recorded in this entry's keyword note, including the checks that led to declining 'ai security'.
• Chatbotscape evaluation methodology. /methodology (continuously updated).