The OWASP LLM Top 10 (LLM-Top10-2026) is the foundational risk taxonomy for large language model applications — covering everything from prompt injection to unbounded resource consumption. Each category below is rated by severity and mapped to concrete mitigations across foundational, hardening, and advanced tiers.
The 10 LLM risk categories
LLM01 Prompt Injection Critical
Untrusted input overrides model instructions — via direct user manipulation, indirect injection through retrieved data and tool outputs, or cross-modal payloads hidden in image, audio, and video content.
LLM02 Sensitive Information Disclosure High
Models surface confidential data — PII, credentials, trade secrets, private training data — in responses through memorisation, over-retrieval, or insufficient output filtering.
LLM03 Excessive Agency Critical
LLM-enabled features with access to tools, plugins, or APIs take autonomous actions with real-world consequences — without appropriate scope limitations, human oversight, or reversibility controls.
LLM04 Supply Chain High
Third-party components — model providers, fine-tuning services, plugins, tool libraries, RAG frameworks — are compromised or malicious, and promoted model artifacts are not what they claim to be: unsigned weights, hijacked conversion services, or namespace reuse on a model hub.
LLM05 Data and Model Poisoning Critical
Training data, fine-tuning datasets, adapters, or model weights are corrupted — causing models to learn backdoored, biased, or degraded behaviours at any stage that writes weights, not just pre-training.
LLM06 Unbounded Consumption High
LLM applications have no resource consumption limits — enabling denial of service and denial of wallet via excessive API calls, token flooding, context window exhaustion, reasoning loops, or disproportionate compute consumption.
LLM07 Misinformation High
LLMs generate confident, plausible, but factually incorrect information — hallucinations, fabricated citations, outdated facts — that users or downstream systems act upon as if true.
LLM08 Hidden Context Exposure High
Non-user-facing context — the system prompt, developer instructions, retrieved policy text, and the tool and function schemas exposed to the model — is extracted, inferred, or reconstructed, handing attackers credentials, control logic, and concrete targets.
LLM09 Vector and Embedding Weaknesses Medium
Embedding stores used in RAG systems are vulnerable to cross-tenant leakage, semantic injection, direct database access, and integrity attacks on stored vector representations.
LLM10 Improper Output Handling High
LLM output is processed by downstream systems (code interpreters, browsers, SQL engines, compilers, repositories) without sanitisation — enabling XSS, code injection, SSRF, or privilege escalation via crafted model responses and insecure generated code.
Mapped to 25 industry frameworks
Every LLM risk category above is mapped, control-by-control, to frameworks including NIST AI RMF, ISO/IEC 42001, MITRE ATLAS, AIUC-1, OWASP ASVS, EU AI Act, and 19 more — with severity, mitigation tier, and cross-references to the OWASP Top 10 for Agentic AI and DSGAI. Explore the full AI standards crosswalk or use the interactive tool below.