LLM - OWASP Top 10 (Comprehensive Guide to LLM Security)
Large Language Model (LLM) applications introduce new attack surfaces across prompts, retrieval pipelines (RAG), tools and MCP servers, agent loops, vector stores, and ML supply chains. This section follows the OWASP Top 10 for LLM Applications 2026, published by the OWASP GenAI Security Project on 4 August 2026, and turns each risk into tests you can actually run against a deployed integration.
What you’ll find here:
- Clear descriptions of each risk, tailored to real LLM architectures
- Three hands-on penetration-testing pages under every category, each anchored to a concrete integration: RAG connectors, model gateways, agent tool loops, MCP clients and servers, vector databases, fine-tuning pipelines, inference servers, and coding assistants
- Detailed examples and proofs you can reproduce safely
- Prioritized remediation and prevention checklists
The 2026 Categories
- LLM01: Prompt Injection - direct, indirect and cross-modal instruction injection through anything the model reads.
- LLM02: Sensitive Information Disclosure - data leaving through retrieval, traces, and memorized training records.
- LLM03: Excessive Agency - what an agent’s tools can do once an attacker is steering them.
- LLM04: Supply Chain - models, adapters, artifacts and MCP servers you did not write.
- LLM05: Data and Model Poisoning - durable corruption of training data, indexes and agent memory.
- LLM06: Unbounded Consumption - compute, cost and model extraction without limits.
- LLM07: Misinformation - confidently wrong output that downstream systems act on.
- LLM08: Hidden Context Exposure - system prompts, tool schemas and other context that should never have been reachable.
- LLM09: Vector and Embedding Weaknesses - the retrieval substrate itself: embeddings, indexes, rerankers.
- LLM10: Improper Output Handling - model output reaching renderers, executors and code review unchecked.
What Changed Since the 2023 List
- Excessive Agency climbed to third, the largest promotion in the 2026 edition, reflecting how much production risk now sits in agentic deployments rather than in single-turn chat.
- Unbounded Consumption rose to sixth and absorbed the old Model Denial of Service and Model Theft entries - cost exhaustion and model extraction are the same class of unbounded use.
- Hidden Context Exposure replaces System Prompt Leakage and covers all non-user-visible context: system and developer instructions, business logic, retrieval schemas, tool definitions, and the credentials embedded in them.
- Data and Model Poisoning widened from Training Data Poisoning to include fine-tuning subversion, adapter swaps and agent memory.
- Misinformation replaces Overreliance, and Improper Output Handling (formerly Insecure Output Handling) fell from fifth to tenth while growing to cover insecure AI-generated code.
- Vector and Embedding Weaknesses is a category the 2023 list did not have at all, alongside the retirement of Insecure Plugin Design, whose subject matter now sits under Excessive Agency.
Use these pages for secure design reviews, red-teaming exercises, AI integration assessments, and building robust guardrails.
In this section
- LLM01: Prompt InjectionAn LLM makes no architectural distinction between instructions and data: system prompt, user turn, retrieved…
- LLM02: Sensitive Information DisclosureSensitive information disclosure happens when an LLM integration hands regulated, privileged or proprietary…
- LLM03: Excessive AgencyExcessive agency is the gap between what an agent is asked to do and what its tooling permits it to do.
- LLM04: Supply ChainAn LLM deployment inherits trust from everything it loads: base weights, fine-tune checkpoints, LoRA adapters,…
- LLM05: Data and Model PoisoningData and model poisoning is durable corruption of the state a system learns from, rather than a single malicious prompt.
- LLM06: Unbounded ConsumptionUnbounded consumption occurs when a caller can trigger inference work costing the operator far more than it costs to request.
- LLM07: MisinformationMisinformation is output that is incorrect, incomplete, unsupported or misleading, and credible enough that something acts on it.
- LLM08: Hidden Context ExposureHidden context is everything assembled into the model's window that the user never wrote and was never meant…
- LLM09: Vector and Embedding WeaknessesVector and embedding weaknesses are failures in the retrieval substrate rather than in the model or the prompt.
- LLM10: Improper Output HandlingImproper output handling is what the application does with a model-generated string before something else interprets it.
Last updated
