OWASP Top 10 for LLM Applications, explained

The OWASP Top 10 for LLM Applications is a community-developed awareness document from the OWASP GenAI Security Project that ranks the most critical security risks facing applications built on large language models. The project describes its output as written "for developers, architects, data scientists, security practitioners, and organizations building or operating applications that use large language models." It follows the same format OWASP has used since 2003 for its web application Top 10 (see our OWASP Top 10:2025 guide): a ranked, consensus-built list of risk categories rather than a scoring formula or compliance checklist.

Two editions worth knowing: 2025 and 2026

The list has moved fast. A 2025 edition, released in March 2025, was the first widely cited version. The GenAI Security Project has since published an OWASP GenAI LLM Top 10 2026 edition — the publication page for it states this release was published 4 August 2026. OWASP's original project repository for the 2025-era list (OWASP/www-project-top-10-for-large-language-model-applications) now carries a notice that it "is maintained as a legacy entry point and historical archive," with active development moved to a dedicated GenAI-Security-Project/GenAI-LLM-Top10 repository. Anyone linking to or quoting "the OWASP LLM Top 10" should check which edition a source is describing, since the item names, codes and order differ between them.

The ten risks in the current (2026) edition

Per the current GenAI-Security-Project repository:

What moved between 2025 and 2026

In the 2025 edition the order was Prompt Injection, Sensitive Information Disclosure, Supply Chain, Data and Model Poisoning, Improper Output Handling, Excessive Agency, System Prompt Leakage, Vector and Embedding Weaknesses, Misinformation, and Unbounded Consumption. Comparing the two lists: Prompt Injection and Sensitive Information Disclosure keep the top two positions; Excessive Agency and Supply Chain both move up several places; Improper Output Handling drops from fifth to tenth; and System Prompt Leakage, a named item in 2025, no longer appears by that name — the 2026 list instead introduces Hidden Context Exposure as item eight. The project's own README for the new edition states it "combines community judgment with analysis of real-world incidents and updates the ordering, scope, examples, mitigations, and framework mappings across the list," but does not publish an item-by-item changelog, so the precise scope relationship between "System Prompt Leakage" and "Hidden Context Exposure" is not confirmed in the source material reviewed for this guide — treat it as a related-but-redefined category rather than an exact rename until OWASP publishes a mapping.

Why device and firmware makers should care

This list targets LLM-application risks specifically — prompt handling, model supply chain, output validation, agentic tool access — not the conventional application or network risks a product may also carry. A device or service that adds an AI assistant, an agentic automation feature, or a chatbot support interface sits on top of whatever else it already exposes: a camera with an LLM-driven voice assistant still has firmware, network and authentication attack surface covered by OWASP IoT Top 10 and the OWASP Top 10:2025 web risks, plus whichever of these ten LLM-specific risks apply to how the model is prompted, what data it can see, and what actions (Excessive Agency, item three) it is allowed to take on the user's or device's behalf. Supply Chain (item four) is also directly relevant to firmware teams adopting third-party or open-weight models: the same questions asked of a software dependency — provenance, known weaknesses, update path — apply to a bundled model or model-serving component.

A workable starting point

1. Map which of the ten risks actually apply to how the LLM feature is wired — a read-only summarisation feature has a very different risk profile from an agent with tool-calling and account access.
2. Treat Prompt Injection and Excessive Agency as the pair to design around first if the feature can take any action beyond generating text, since untrusted input plus granted agency is the combination behind most reported real-world incidents.
3. Apply Supply Chain thinking to the model itself, not only to the surrounding code — know where a bundled or fine-tuned model came from and what changes when it is updated.
4. Confirm which edition (2025 vs. 2026) a given source, tool or checklist is built against before treating item codes as interchangeable across years.

SoftWSP's device and firmware assessments can factor in AI-driven features alongside conventional firmware and application risk: see device firmware security.

This guide summarises public OWASP GenAI Security Project resources as fetched in October 2026; it does not constitute legal or compliance advice.