OWASP LLM Top 10 Cheat Sheet (2026): All 10 Risks & Fixes
The OWASP Top 10 for LLM Applications is the industry’s map of how AI systems get broken. This is the 2026 edition (released Aug 2026) in one screen — every category, the attack in a line, and the fix in a line, each linked to a full cheat sheet. When you want to land these instead of just read them, run the hands-on LLM security lab.
Understand, then test only what’s yours. Knowing these risks is defensive work. Actually attacking an AI system — prompt injection, agency abuse, data exfiltration — is only legitimate against a model you own or are explicitly authorised to assess.
What changed in the 2026 edition
If you learned the 2025 list, most of the risks are the same — but eight of the ten moved and one was renamed. The headline shifts:
- Excessive Agency jumped from #6 to #3 — agents doing real things is now a top-tier risk.
- Unbounded Consumption rose from #10 to #6, as agentic apps make many calls per task.
- System Prompt Leakage was renamed Hidden Context Exposure (#8) and broadened to cover everything assembled into the model’s context that users aren’t meant to see.
- Improper Output Handling dropped from #5 to #10 — still real, just out-climbed by newer agentic risks.
The 2026 Top 10 at a glance
| # | Risk | The attack | The fix |
|---|---|---|---|
| LLM01 | Prompt Injection | Crafted input overrides the model’s instructions, direct or hidden in content it reads. | Separate trusted instructions from untrusted input; constrain tools; validate output. |
| LLM02 | Sensitive Information Disclosure | Private data — PII, secrets, another user’s data — reaches the output. | Minimise data in; per-user authz on retrieval; filter output; keep secrets out of prompts. |
| LLM03 | Excessive Agency | An over-permissioned agent takes real actions it shouldn’t — the biggest riser in 2026. | Least-privilege tools, human-in-the-loop for high-impact actions, hard scopes and caps. |
| LLM04 | Supply Chain | A poisoned model, dataset, or dependency is trusted and pulled into your stack. | Verify provenance, pin and scan components, treat models and datasets as software. |
| LLM05 | Data and Model Poisoning | Tampered training / fine-tuning data plants a bias or a backdoor. | Know your data’s provenance, validate datasets, guard the feedback loop, red-team for triggers. |
| LLM06 | Unbounded Consumption | No limits → denial of service, denial of wallet, or model extraction — up from #10. | Rate-limit and quota, cap inputs and agent loops, budget alerts, watch for extraction. |
| LLM07 | Misinformation | Confident false or insecure output — hallucinations, bad code, invented packages. | Ground with retrieval, human review for high-stakes, security-review AI code, verify sources. |
| LLM08 | Hidden Context Exposure | The system prompt or hidden context leaks — renamed & broadened from “System Prompt Leakage”. | Keep secrets out of context, never enforce authz in the prompt, treat context as public. |
| LLM09 | Vector and Embedding Weaknesses | RAG / embedding flaws — poisoned or over-broad retrieval, embedding inversion. | Per-user access on the vector store, validate ingested docs, isolate tenants. |
| LLM10 | Improper Output Handling | Downstream systems trust model output → XSS, SQLi, command execution — dropped from #5. | Treat output as untrusted input: encode, parameterise, sandbox, validate. |
Each risk above links to a StashGrid cheat sheet with the threats, defences and cross-links in full. A close cousin of LLM01 worth its own page: LLM jailbreaks.
How to use this list
- Map your app to it. Walk each row and ask “could this happen here?” — the gaps become your backlog.
- Prioritise by what you run. Building agents? LLM03 and LLM06 matter most. A RAG app? LLM02, LLM08 and LLM09. A public API? LLM06 and LLM10.
- Practise, don’t just read. The LLMVault lab lets you exploit and then defend several of these hands-on.
Go deeper
- Try it: the Gandalf beginner lab — talk a hosted chatbot out of its password; fifteen minutes, no setup
- Place these on a full intrusion with the Cyber Kill Chain — AI attacks follow the same arc.
- Every AI cheat sheet lives in the reference archive.
- Official source: the OWASP GenAI Security Project.
The OWASP GenAI LLM Top 10, 2026 edition (released Aug 2026), distilled to one screen and tied to hands-on practice. Spotted a shift we missed? Tell me.
Related — LLM Security
- Part of the LLM Security map — all ten OWASP LLM risks in one place.
- Prompt Injection
- AI Agent Security
- RAG Security
- Try it hands-on: the LLMVault lab