OWASP's 2026 LLM Top 10 Now Weighs Real Incidents, Not Just Opinion

What changed in the 2026 list

OWASP has published the 2026 edition of its GenAI/LLM Top 10, and the headline is methodological rather than cosmetic: this is the first version scored using a documented 75%/25% blend of practitioner-community voting and real-world incident data, rather than expert opinion alone. According to reporting on the release, the incident-data component drew on 6,639 classified AI security incidents pulled from public vulnerability databases and an AI-harm database.

The evidence-weighted method reshuffled eight of the ten entries. The new order:

1. 1Prompt Injection (unchanged)
2. 2Sensitive Information Disclosure (unchanged)
3. 3Excessive Agency (up from #6)
4. 4Supply Chain (down from #3)
5. 5Data and Model Poisoning (down from #4)
6. 6Unbounded Consumption (up from #10)
7. 7Misinformation (up from #9)
8. 8Hidden Context Exposure — renamed from System Prompt Leakage (was #8)
9. 9Vector and Embedding Weaknesses (down from #8)
10. 10Improper Output Handling (down from #5)

Why the agentic-risk jump matters

Excessive Agency climbing from sixth to third is the biggest single move in the list, and it tracks with what we're seeing in the field: as teams wire LLMs into tools, ticketing systems, and downstream APIs, the failure mode shifts from "the model said something wrong" to "the model *did* something wrong." An over-permissioned agent that can call a refund API, push code, or send email doesn't need a sophisticated exploit to cause damage — it just needs a plausible-sounding instruction, injected or otherwise, that its permissions don't stop it from acting on.

Unbounded Consumption and Misinformation rose for related reasons. Incident data reportedly showed confidently wrong outputs triggering automated workflows or unauthorized API calls downstream — the cost of a hallucination is no longer just reputational when an agent acts on it. Meanwhile Improper Output Handling dropping from #5 to #10 doesn't mean the underlying flaw got fixed in the wild; OWASP's own framing attributes the drop to shifting incident *prevalence*, not resolution — worth noting before anyone deprioritizes output sanitization on the strength of a rank number alone.

A broader definition of context leakage

The rename of System Prompt Leakage to Hidden Context Exposure is a scope expansion, not a relabel. It now explicitly covers retrieved policy text, tool schemas, and workflow rules — the kind of material RAG pipelines and agent frameworks inject into context that was never meant to be user-visible. Teams that treated "don't leak the system prompt" as a checkbox should re-read this category; the attack surface it describes is now the entire non-user-visible context window, not one string.

What this means for defenders

The practical takeaway isn't the ranking itself — it's that OWASP is now grounding prioritization in incident evidence, which gives security teams a citable basis for arguing resource allocation internally. If your organization is running LLM-backed agents with real-world write access (ticketing, payments, code, infrastructure), Excessive Agency and Unbounded Consumption deserve fresh threat-modeling attention even if your last review used the 2025 list as a checklist.

FAQ