OWASP Top 10 for LLM applications

Why it matters

A list of ten risks is not a security programme, but it is the vocabulary reviewers, auditors and interviewers share. When a design review asks whether you have been through the OWASP list, the useful answer walks the entries and says where each is caught in your system. The 2026 edition matters because it records what changed as products moved from chat to agents: prompt injection stays first, sensitive information disclosure stays second, and excessive agency climbs to third. The System Design track's Security module covers the classic application list; this lesson covers the one written for model-backed systems.

The idea

A map, not a checklist

The list ranks risks by how often practitioners see them and how much they cost. Use it as a map of the surface: each entry names a place where a model-backed system can be made to misbehave, each has a control, and each control lives in a lesson of this track.

The entries

Prompt injection (first). Any text that reaches the window can steer the model. Control: frame content as data, scope tools, gate actions, scan and test. The Prompt injection lesson.

Sensitive information disclosure (second). The model reveals what it should not: another tenant's documents, a secret in context, personal data. Control: permission filters before ranking, redaction before the model, output leak checks. The PII and data boundaries lesson and Permission-aware and multi-tenant retrieval.

Excessive agency (third). More permission, functionality or autonomy than the task needs, so a mistake or an injection becomes an action. Control: least privilege, confirmation gates, separation of duties. The Excessive agency and least privilege lesson.

Data and model poisoning. Training, tuning or embedding data is manipulated to plant behaviour or a backdoor; the 2026 edition broadens it to cover fine-tuning subversion. Control: provenance on every training set, held-out evals for unexpected behaviour, review of tuning data. The Fine-tuning module, and the Forgetting, revision and memory poisoning lesson for memory as a channel.

Supply chain. A model, adapter, dataset, library or plugin pulled from a registry with a backdoor or a licence problem. Control: pin and verify artefacts, prefer signed weights, read the card. The Model families and reading a model card lesson.

Hidden context exposure. Renamed from system prompt leakage: any operational context the model holds (system prompt, tool descriptions, retrieved policy, internal notes) is discoverable, so assume it is. Control: keep secrets and authorisation logic out of the window; enforce in code. This lesson and the Guardrails lesson.

Vector and embedding weaknesses. The index leaks across tenants, returns poisoned chunks, or lets embeddings be inverted back to text. Control: filter by permission before ranking, validate ingested content, treat the index as data. Permission-aware retrieval and the Vector stores lesson.

Misinformation. The model states falsehoods with confidence and the product passes them on. Control: grounding, citations, faithfulness evals, a human for consequential answers. The Hallucination lesson and the RAG metrics lesson.

Unbounded consumption. An input or a loop drives cost or capacity without limit. Control: token, step and spend budgets, rate limits per user, timeouts. The Stop conditions lesson and Cost and token accounting.

Improper output handling (tenth). Model output reaches a browser, shell or database unescaped, so the model becomes the source of a classic injection. Control: treat output as untrusted input to the next component; escape, parameterise, validate against a schema. The Structured output lesson, and the Security module in System Design.

What changed from 2025

Three moves tell the story. Excessive agency rose because agents now act: the cost of a bad decision is no longer a wrong paragraph but a sent email or a deleted record. Improper output handling fell, not because it stopped being real but because schema-constrained output and framework defaults now catch the common cases. System prompt leakage became hidden context exposure, which admits that the secret was never just the prompt: tool lists, retrieved policy, memory and anything else in the window can be extracted, so nothing in the window may be a secret. Misinformation and unbounded consumption rose as products reached more users and more loops.

The list in a design review

Walk the architecture diagram and, for each entry, ask where it would be caught: which component, which test, which log. An entry with no answer is a finding. Record the answers as a table: entry, control, owner, evidence. Then ask the harder question: which entries combine? An injection (first) landing in an agent with broad tools (third) that holds customer records (second) is the incident to design against, not three separate rows. Agent-specific risks (tools, cross-session memory, downstream consequences) live in a separate Agentic Top 10, covered in the last lesson of this module.

	Symptom	Control	Where it is caught
Prompt injection	The model follows text from a page or an email	Framing, scoped tools, gates, a scan pass	Content ingestion and the action layer
Sensitive information disclosure	An answer contains another tenant's data or a secret	Permission filter before ranking, redaction, output leak check	Retrieval and the output guard
Excessive agency	A wrong or injected step becomes an email or a deletion	Least privilege, confirmation gates, separation of duties	The tool registry and the policy layer
Hidden context exposure	A user extracts the system prompt or the tool list	No secrets in the window; authorisation in code	Design review; nothing to catch at runtime
Unbounded consumption	One user or one loop burns the budget	Token, step and spend limits; rate limits	The agent loop and the gateway