The OWASP GenAI LLM Top 10 2026, released on August 3, 2026, keeps prompt injection at number one and promotes excessive agency into the top three, with two sections renamed. More important than the shuffling is how the list is built: this edition is the first one that weighs real incident data against the opinions of hundreds of practitioners. The community vote still carries 75 percent of the ranking weight, and results from 7,714 public AI security incidents supply the remaining 25 percent. Where the two disagree, the evidence is the signal, and those gaps are where the real lessons sit.

What is New in the 2026 Edition

Ranking	Entry	Change from 2025
1	Prompt Injection	Unchanged
2	Sensitive Information Disclosure	Unchanged
3	Excessive Agency	Moved up
4	Supply Chain	Renamed and expanded
5	Data and Model Poisoning	Moved up
6	Unbounded Consumption	Up 4 places
7	Misinformation	Widest gap with evidence
8	Hidden Context Exposure	Renamed, was System Prompt Leakage
9	Vector and Embedding Weaknesses	Expanded scope
10	Improper Output Handling	Down 5 places

The 2025 list ran on expert judgment alone. Practitioners voted on what they believed were the biggest risks, and that vote ordered the list. The 2026 edition keeps the vote but adds a counterweight: a curated set of incidents pulled from public vulnerability databases and an AI-harm database.

Why Prompt Injection Stays on Top

Prompt injection holds rank one even though incident data alone would not place it in the top ten. That gap is not proof it is safe. It is because production teams fight injection so hard that few clean exploits end up in public reports, so the data understates how often it is tried. These teams already know the attack surface: anywhere a model reads untrusted input. The vote keeps injection at number one because the people doing the work see it every day.

The 2026 entry also widens the definition. Injection is no longer just text. It now covers instructions hidden inside images or audio, which matters for any application that accepts multimodal input.

Excessive Agency Moves Into the Top Three

The report describes the risk an LLM given tools and permissions can be tricked into using them in harmful ways. Both the community vote and the incident data agree this is where real damage occurs in production. The entry makes the point bluntly: giving a model access to file systems, APIs, or email without limiting permissions and requiring human approval for important actions is no longer a design oversight. It is a top-three vulnerability.

The practical rule: if a model can read, write, or act, it should do so within the smallest permission set that works, and actions with real impact need a human in the loop.

The Entries That Moved

Unbounded Consumption climbed four places. A single prompt can now trigger expensive reasoning chains, repeated tool calls, or extended processing that runs up a large cloud bill. The standard defense, limiting requests per second, does not help when the cost is measured per token rather than per request. Teams who pay per token for agents or long chains should treat this as an active cost risk.

Misinformation is the biggest gap between what experts worried about and what incidents show. Experts ranked it low. The evidence ranked it high. When a model produces fluent, confident output that drives a real decision or an automated action, a wrong answer becomes a wrong outcome. The 2026 list moved it up because the record demanded it, especially for systems that act on model output.

Supply Chain was renamed and expanded to cover model artifacts too. The text now includes the risk of pulling a model from a public registry by name, only to have the name taken over with a malicious replica, and third-party components that change model behavior at runtime. This is the same name-squatting problem that has bitten npm and PyPI, now applied to AI artifacts.

Data and Model Poisoning now explicitly covers changing a model's behavior by modifying configuration files or prompts, even when the model weights are untouched. That shift reflects attacks that no longer need access to training data.

System Prompt Leakage was renamed Hidden Context Exposure, and the scope widened. The risk was never only the system prompt itself. It is everything the model sees that the user should not: tool descriptions, role definitions, safety rules, formatting instructions. The guidance is direct: assume every item in the model's context is discoverable, never place credentials there, and never rely on context secrecy as a security control.

Improper Output Handling fell to tenth place. The drop is not because the risk went away. More teams now treat output validation as part of standard application security, which is exactly what the section recommends.

Vector and Embedding Weaknesses kept its slot but grew in scope, covering retrieval pipelines and embedding stores as a first-class attack surface.

Where This List Stops and Agentic AI Starts

The report draws a clear dividing line. The GenAI LLM Top 10 describes the risk when the model is a component inside an application you build. The moment the model starts acting on its own with tools it can call and actions it can take, the risk belongs to the companion OWASP Top 10 for Agentic Applications. Many real incidents sit exactly on that boundary. If your service lets a model make decisions and act on them, read both lists.

What This Means for Developers

The authors of the report are explicit that prompt injection cannot be reliably prevented at the model level. The defense has to live in the system around the model. Build as if injection will succeed, then limit what a compromised model can reach and what its outputs can do.

Start with these controls:

• Give models as little access as possible: scoped permissions, ephemeral credentials, no default calls to internal systems.
• Require human approval for any action with financial, data, or access impact.
• Validate and constrain model output before it reaches other systems, especially for automatic flows.
• Treat context as visible to anyone: no secrets in prompts, tool definitions, or logs.
• Watch token consumption on agent loops and long chains, and budget for it.
• Verify the provenance of models and components you pull from registries.

The existing practices of least privilege, input validation, and supply chain hygiene already map well onto this list. The Top 10 is just the map of where to apply the same instinct.

Frequently Asked Questions

Q: When was the OWASP GenAI LLM Top 10 2026 released? A: The report was published on August 3, 2026, on the official project page.

Q: Is prompt injection still the biggest risk? A: It ranked first again. The report notes the incident data alone would place it lower, but every model reads untrusted input somewhere, so practitioners keep it at the top.

Q: What changed in the rankings from 2025? A: Excessive Agency and Misinformation moved up. Data and Model Poisoning moved up. Unbounded Consumption rose four places. System Prompt Leakage became Hidden Context Exposure, and Improper Output Handling dropped to tenth.

Q: Does this apply to autonomous agents? A: Partly. The GenAI list covers the model as a component inside an app. For models with tools and independent action, OWASP's companion Top 10 for Agentic Applications is the right checklist.

Q: How was this list different from previous years? A: It was the first edition to mix the community vote with records: experts weight 75 percent, and 7,714 collected incidents weight 25 percent.

Key Takeaways

• Prompt injection leads again: every model reads untrusted input somewhere, and the vote reflects that.
• Excessive Agency broke into the top three; granting models tools without permission limits is a top vulnerability.
• Misinformation rose because incident data outranked expert expectations, especially for any system that acts on output.
• Supply chain and output validation are now standard appsec patterns extended to AI artifacts.

Conclusion

The OWASP GenAI LLM Top 10 2026 is less about new categories and more about the discipline to keep the list honest. It confirms the trends developers already feel in production: injection is everywhere, agency is the real damage surface, provenance of models matters, and answer quality is a vulnerability class of its own. The good news is the fix list is short. It starts with least privilege, human approval of high-impact actions, and never trusting the raw context.

---

Sources: OWASP GenAI LLM Top 10 2026 release, OWASP GenAI LLM Top 10 2026 analysis, OWASP Top 10 for Agentic Applications