Is the OWASP LLM Top 10 a compliance requirement?

No. The OWASP Top 10 is not a law, regulation, certification, or mandatory compliance framework. Organizations use it as security guidance for identifying and mitigating AI application risks.

What is the current OWASP LLM Top 10 version?

The current release is the OWASP GenAI LLM Top 10 2026, published in August 2026. The 2025 version remains useful as a reference for the evolution of LLM security risks.

What is prompt injection?

Prompt injection occurs when inputs manipulate an LLM's behavior or output in unintended ways. Attacks can involve direct user prompts or instructions embedded in external content consumed by an AI system.

What is sensitive information disclosure in an LLM application?

It is the exposure of sensitive information through an LLM or its surrounding application. This can include personal information, financial information, credentials, proprietary information, system information, or other confidential data.

Why is excessive agency a security risk?

LLM applications can be given access to tools, APIs, databases, or other systems. If permissions are broader than necessary, a compromised or manipulated model may be able to perform unintended or unauthorized actions.

What are vector and embedding weaknesses?

These are security weaknesses involving embeddings, vector databases, and RAG architectures. Improper isolation, access controls, or retrieval design can allow sensitive information to be retrieved or influence model responses in unintended ways.

Does the OWASP Top 10 apply to generative AI?

Yes. The project has evolved into the broader OWASP GenAI Security Project, which covers security and safety risks associated with generative AI, LLMs, agentic AI, and AI-driven applications.

Does OWASP certify applications against the LLM Top 10?

The OWASP LLM Top 10 is guidance rather than a certification scheme. Organizations can use it to assess and improve their AI application security, but there is no OWASP LLM Top 10 certification that automatically demonstrates compliance.

How does OWASP LLM Top 10 differ from NIST AI RMF?

NIST AI RMF provides a broader framework for managing AI risk across an organization and AI lifecycle. OWASP LLM Top 10 focuses specifically on security vulnerabilities and risks affecting LLM and generative AI applications.

OWASP Top 10 for LLM Applications

Q: What is the OWASP Top 10 for LLM Applications?

It is a security guidance resource developed by the OWASP GenAI Security Project to identify and address critical security risks affecting applications powered by large language models and generative AI.

Understand the security risks that can affect LLM-powered applications and the controls organizations can use to protect models, data, applications, and connected systems.

Current Release: OWASP GenAI LLM Top 10 2026Type: Security GuidanceScope: LLM & Generative AI Applications

What Is the OWASP Top 10 for LLM Applications?

The OWASP Top 10 for Large Language Model Applications is a community-driven security resource developed by the OWASP GenAI Security Project to identify and address critical security risks in applications powered by large language models and generative AI.

The project was created as LLMs became increasingly embedded in applications, business processes, and enterprise workflows. Its purpose is to help developers, security teams, architects, and organizations understand how AI-specific vulnerabilities can affect applications and how those risks can be mitigated.

The current release is the OWASP GenAI LLM Top 10 2026, published in August 2026. The project has evolved from the original 2023 list into a broader GenAI security initiative covering LLMs, generative AI, and agentic AI systems.

Unlike regulations such as GDPR or the EU AI Act, the OWASP Top 10 is not a law, certification, or mandatory compliance standard. It is security guidance that organizations can use to identify vulnerabilities, establish security controls, and strengthen the development and operation of LLM applications.

OWASP Top 10 for LLM Applications

Understand the security risks that can affect LLM-powered applications and the controls organizations can use to protect models, data, applications, and connected systems.

Current Release: OWASP GenAI LLM Top 10 2026Type: Security GuidanceScope: LLM & Generative AI Applications

What Is the OWASP Top 10 for LLM Applications?

What Does the OWASP LLM Top 10 Cover?

The OWASP Top 10 identifies critical security risks associated with LLM and generative AI applications. The categories cover risks across application inputs, models, data, outputs, connected systems, and runtime operations.

LLM01

Prompt Injection

Malicious or unintended instructions that manipulate an LLM's behavior, potentially causing data disclosure, unauthorized actions, or compromised decisions.

LLM02

Sensitive Information Disclosure

Exposure of personal, confidential, proprietary, credential, or other sensitive information through LLM interactions and application behavior.

LLM03

Supply Chain

Security risks introduced through third-party models, datasets, plugins, libraries, services, and other components in the LLM supply chain.

LLM04

Data & Model Poisoning

Manipulation of training, fine-tuning, or embedding data that can introduce vulnerabilities, backdoors, bias, or unintended model behavior.

LLM05

Improper Output Handling

Failure to properly validate, sanitize, or control LLM-generated output before it reaches downstream applications or systems.

LLM06

Excessive Agency

Risks created when LLM applications have excessive permissions or autonomy to perform actions through connected tools and systems.

LLM07

System Prompt Leakage

Exposure of system prompts, hidden instructions, or other information developers intended to keep from users or attackers.

LLM08

Vector & Embedding Weaknesses

Security weaknesses in vector databases, embeddings, and Retrieval-Augmented Generation systems that can affect data isolation, retrieval integrity, and model behavior.

LLM09

Misinformation

Generation or propagation of false, misleading, or unreliable information that can create security, operational, legal, or reputational risks.

LLM10

Unbounded Consumption

Excessive or uncontrolled consumption of model resources that can lead to denial of service, unexpected costs, degraded availability, or resource exhaustion.

What Does the OWASP LLM Top 10 Cover?

LLM01

Prompt Injection

Malicious or unintended instructions that manipulate an LLM's behavior, potentially causing data disclosure, unauthorized actions, or compromised decisions.

LLM02

Sensitive Information Disclosure

Exposure of personal, confidential, proprietary, credential, or other sensitive information through LLM interactions and application behavior.

LLM03

Supply Chain

Security risks introduced through third-party models, datasets, plugins, libraries, services, and other components in the LLM supply chain.

LLM04

Data & Model Poisoning

Manipulation of training, fine-tuning, or embedding data that can introduce vulnerabilities, backdoors, bias, or unintended model behavior.

LLM05

Improper Output Handling

Failure to properly validate, sanitize, or control LLM-generated output before it reaches downstream applications or systems.

LLM06

Excessive Agency

Risks created when LLM applications have excessive permissions or autonomy to perform actions through connected tools and systems.

LLM07

System Prompt Leakage

Exposure of system prompts, hidden instructions, or other information developers intended to keep from users or attackers.

LLM08

Vector & Embedding Weaknesses

Security weaknesses in vector databases, embeddings, and Retrieval-Augmented Generation systems that can affect data isolation, retrieval integrity, and model behavior.

LLM09

Misinformation

Generation or propagation of false, misleading, or unreliable information that can create security, operational, legal, or reputational risks.

LLM10

Unbounded Consumption

Excessive or uncontrolled consumption of model resources that can lead to denial of service, unexpected costs, degraded availability, or resource exhaustion.

OWASP LLM Top 10 at a Glance

Get a quick overview of the OWASP LLM Top 10, including its scope, current release, and core security focus. Understand how the framework helps identify and mitigate risks across LLM-powered applications and AI workflows.

FrameworkOWASP Top 10 for LLM Applications

Current ReleaseOWASP GenAI LLM Top 10 2026

PublisherOWASP GenAI Security Project

TypeSecurity Guidance

FocusLLM & Generative AI Application Security

ApplicationDevelopment, deployment, and management lifecycle

AudienceDevelopers, security teams, architects, AppSec, DevSecOps, AI/ML teams

ApproachRisk identification and mitigation

Who Should Consider the OWASP LLM Top 10?

The OWASP LLM Top 10 is relevant to organizations developing, deploying, integrating, or securing LLM-powered applications.

AI Developers

Teams building applications powered by LLMs, generative AI models, RAG pipelines, or AI agents.

Application Security Teams

Security teams responsible for identifying vulnerabilities in AI-enabled applications and integrating AI security into existing AppSec programs.

AI & ML Teams

Teams developing, fine-tuning, evaluating, deploying, or maintaining models and AI systems.

Enterprise AI Teams

Organizations introducing copilots, AI assistants, internal LLM applications, or generative AI into business workflows.

DevSecOps & Engineering Teams

Teams responsible for securing AI applications throughout development, deployment, and production.

Security & Risk Leaders

CISOs, security architects, AI security teams, and risk leaders establishing controls for enterprise AI adoption.

LLM Security Readiness Checklist

Identify all LLM and generative AI applications in use

Inventory models, APIs, plugins, tools, datasets, and other AI dependencies

Test applications for direct and indirect prompt injection

Detect sensitive information entering AI prompts and contexts

Protect credentials, API keys, secrets, and confidential data

Validate and sanitize LLM outputs before downstream use

Apply least-privilege access to AI tools and connected systems

Limit the actions and permissions available to AI agents

Protect system prompts and sensitive application instructions

Secure vector databases, embeddings, and RAG pipelines

Assess third-party models and AI components for supply-chain risks

Monitor training, fine-tuning, and retrieval data for poisoning risks

Establish controls for inaccurate or misleading AI outputs

Monitor AI applications for abnormal or excessive resource consumption

Log and investigate security-relevant AI interactions

Continuously test AI applications against emerging attack techniques

How OWASP LLM Top 10 Fits Into the AI Security Landscape

The OWASP LLM Top 10 can complement broader AI governance, risk, security, and compliance frameworks.

NIST AI RMF

NIST AI RMF provides a broader approach to AI risk management through Govern, Map, Measure, and Manage. OWASP provides more focused security guidance for vulnerabilities specific to LLM and generative AI applications.

ISO/IEC 42001

ISO/IEC 42001 establishes requirements for an Artificial Intelligence Management System. OWASP LLM Top 10 can provide technical security considerations that support an organization's broader AI governance and risk-management program.

EU AI Act

The EU AI Act establishes legally binding requirements for AI systems within its scope. OWASP LLM Top 10 is not a regulatory framework, but its security guidance can help organizations address technical risks relevant to AI security and risk management.

MITRE ATLAS

MITRE ATLAS provides a knowledge base of adversary tactics and techniques targeting AI-enabled systems. OWASP focuses on application vulnerabilities and mitigation guidance, while ATLAS provides an attacker-oriented view of AI threats.

OWASP Top 10 for Agentic Applications

As LLM applications increasingly gain autonomy and access to external tools, agentic AI introduces additional security concerns. OWASP now maintains dedicated guidance for agentic applications, complementing the LLM Top 10 with risks around agent goals, tool use, identity, memory, and autonomous actions.

Frequently Asked Questions

Official OWASP Resources

For authoritative information and community resources about the OWASP Top 10 for Large Language Model Applications, refer to official OWASP documentation:

OWASP Top 10 for LLMs

OWASP GenAI LLM Top 10