OWASP LLM Top 10 Cheat Sheet: AI Security Risks (2026)
The OWASP Top 10 for LLM Applications is the industry’s map of how AI systems get broken. This is the 2026 edition (released Aug 2026) in one screen — every category, the attack in a line, and the fix in a line, each linked to a full cheat sheet. When you want to land these instead of just read them, run the hands-on LLM security lab.
Understand, then test only what’s yours. Knowing these risks is defensive work. Actually attacking an AI system — prompt injection, agency abuse, data exfiltration — is only legitimate against a model you own or are explicitly authorised to assess.
What changed in the 2026 edition
If you learned the 2025 list, most of the risks are the same — but eight of the ten moved and one was renamed. The headline shifts:
- Excessive Agency jumped from #6 to #3 — agents doing real things is now a top-tier risk.
- Unbounded Consumption rose from #10 to #6, as agentic apps make many calls per task.
- System Prompt Leakage was renamed Hidden Context Exposure (#8) and broadened to cover everything assembled into the model’s context that users aren’t meant to see.
- Improper Output Handling dropped from #5 to #10 — still real, just out-climbed by newer agentic risks.
The 2026 Top 10 at a glance
| # | Risk | The attack | The fix |
|---|---|---|---|
| LLM01 | Prompt Injection | Crafted input overrides the model’s instructions, direct or hidden in content it reads. | Separate trusted instructions from untrusted input; constrain tools; validate output. |
| LLM02 | Sensitive Information Disclosure | Private data — PII, secrets, another user’s data — reaches the output. | Minimise data in; per-user authz on retrieval; filter output; keep secrets out of prompts. |
| LLM03 | Excessive Agency | An over-permissioned agent takes real actions it shouldn’t — the biggest riser in 2026. | Least-privilege tools, human-in-the-loop for high-impact actions, hard scopes and caps. |
| LLM04 | Supply Chain | A poisoned model, dataset, or dependency is trusted and pulled into your stack. | Verify provenance, pin and scan components, treat models and datasets as software. |
| LLM05 | Data and Model Poisoning | Tampered training / fine-tuning data plants a bias or a backdoor. | Know your data’s provenance, validate datasets, guard the feedback loop, red-team for triggers. |
| LLM06 | Unbounded Consumption | No limits → denial of service, denial of wallet, or model extraction — up from #10. | Rate-limit and quota, cap inputs and agent loops, budget alerts, watch for extraction. |
| LLM07 | Misinformation | Confident false or insecure output — hallucinations, bad code, invented packages. | Ground with retrieval, human review for high-stakes, security-review AI code, verify sources. |
| LLM08 | Hidden Context Exposure | The system prompt or hidden context leaks — renamed & broadened from “System Prompt Leakage”. | Keep secrets out of context, never enforce authz in the prompt, treat context as public. |
| LLM09 | Vector and Embedding Weaknesses | RAG / embedding flaws — poisoned or over-broad retrieval, embedding inversion. | Per-user access on the vector store, validate ingested docs, isolate tenants. |
| LLM10 | Improper Output Handling | Downstream systems trust model output → XSS, SQLi, command execution — dropped from #5. | Treat output as untrusted input: encode, parameterise, sandbox, validate. |
Each risk above links to a StashGrid cheat sheet with the threats, defences and cross-links in full. A close cousin of LLM01 worth its own page: jailbreak techniques.
How to use this list
- Map your app to it. Walk each row and ask “could this happen here?” — the gaps become your backlog.
- Prioritise by what you run. Building agents? LLM03 and LLM06 matter most. A RAG app? LLM02, LLM08 and LLM09. A public API? LLM06 and LLM10.
- Practise, don’t just read. The LLMVault lab lets you exploit and then defend several of these hands-on.
Go deeper
- Place these on a full intrusion with the Cyber Kill Chain — AI attacks follow the same arc.
- Every AI cheat sheet lives in the reference archive.
- Official source: the OWASP GenAI Security Project.
The OWASP GenAI LLM Top 10, 2026 edition (released Aug 2026), distilled to one screen and tied to hands-on practice. Spotted a shift we missed? Tell me.