OWASP LLM Top 10 — Risks & Mitigations

The ten critical security risk categories for large language model applications, published by the OWASP GenAI Security Project and mapped to 25 industry frameworks in GenAI Crosswalk.

The OWASP LLM Top 10 (LLM-Top10-2026) is the foundational risk taxonomy for large language model applications — covering everything from prompt injection to unbounded resource consumption. Each category below is rated by severity and mapped to concrete mitigations across foundational, hardening, and advanced tiers.

The 10 LLM risk categories

LLM01 Prompt Injection Critical

Untrusted input overrides model instructions — via direct user manipulation, indirect injection through retrieved data and tool outputs, or cross-modal payloads hidden in image, audio, and video content.

LLM02 Sensitive Information Disclosure High

Models surface confidential data — PII, credentials, trade secrets, private training data — in responses through memorisation, over-retrieval, or insufficient output filtering.

LLM03 Excessive Agency Critical

LLM-enabled features with access to tools, plugins, or APIs take autonomous actions with real-world consequences — without appropriate scope limitations, human oversight, or reversibility controls.

LLM04 Supply Chain High

Third-party components — model providers, fine-tuning services, plugins, tool libraries, RAG frameworks — are compromised or malicious, and promoted model artifacts are not what they claim to be: unsigned weights, hijacked conversion services, or namespace reuse on a model hub.

LLM05 Data and Model Poisoning Critical

Training data, fine-tuning datasets, adapters, or model weights are corrupted — causing models to learn backdoored, biased, or degraded behaviours at any stage that writes weights, not just pre-training.

LLM06 Unbounded Consumption High

LLM applications have no resource consumption limits — enabling denial of service and denial of wallet via excessive API calls, token flooding, context window exhaustion, reasoning loops, or disproportionate compute consumption.

LLM07 Misinformation High

LLMs generate confident, plausible, but factually incorrect information — hallucinations, fabricated citations, outdated facts — that users or downstream systems act upon as if true.

LLM08 Hidden Context Exposure High

Non-user-facing context — the system prompt, developer instructions, retrieved policy text, and the tool and function schemas exposed to the model — is extracted, inferred, or reconstructed, handing attackers credentials, control logic, and concrete targets.

LLM09 Vector and Embedding Weaknesses Medium

Embedding stores used in RAG systems are vulnerable to cross-tenant leakage, semantic injection, direct database access, and integrity attacks on stored vector representations.

LLM10 Improper Output Handling High

LLM output is processed by downstream systems (code interpreters, browsers, SQL engines, compilers, repositories) without sanitisation — enabling XSS, code injection, SSRF, or privilege escalation via crafted model responses and insecure generated code.

Mapped to 25 industry frameworks

Every LLM risk category above is mapped, control-by-control, to frameworks including NIST AI RMF, ISO/IEC 42001, MITRE ATLAS, AIUC-1, OWASP ASVS, EU AI Act, and 19 more — with severity, mitigation tier, and cross-references to the OWASP Top 10 for Agentic AI and DSGAI. Explore the full AI standards crosswalk or use the interactive tool below.

Explore Full Mappings → Score Your Coverage → View on GitHub