The OWASP LLM Top 10 2026 for AAISM candidates

The OWASP Top 10 for LLM Applications is the community's ranked list of the most critical security risks in applications built on large language models, and its 2026 edition, published in August 2026, reorders it. Prompt Injection keeps first place, Excessive Agency climbs to third, Improper Output Handling falls from fifth to tenth, and System Prompt Leakage becomes Hidden Context Exposure. ISACA's AAISM outline names no framework, OWASP's included, but its topic on AI threat and vulnerability management covers the ground this list maps. This guide lists the 2026 ten, converts the 2025 numbers you may have learned, explains each risk with the controls OWASP gives for it, and shows how a security manager puts the list to work.

The short answer

• The 2026 ten: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Excessive Agency, LLM04 Supply Chain, LLM05 Data and Model Poisoning, LLM06 Unbounded Consumption, LLM07 Misinformation, LLM08 Hidden Context Exposure, LLM09 Vector and Embedding Weaknesses, LLM10 Improper Output Handling.
• What moved: eight of the ten changed number since 2025, and one changed its name. The table below converts.
• How it was ranked: a community vote, now checked against a corpus of incidents. The vote carries three-quarters of the weight and the incident data a quarter.
• Where it stops: the list covers the model as a component of your application. Once the model acts on its own, with tools and memory, OWASP sends you to its Top 10 for Agentic Applications as well.
• For the AAISM: learn what each risk is and which control answers it. The exam's questions are written to test applied knowledge, so the scenario matters more than the entry number.

Is the OWASP Top 10 on the AAISM exam?

Not by name. ISACA's exam content outline, the only official statement of what the AAISM covers, names no framework or catalog. What it does name is the work. Domain 2 has a topic called 2B, AI Threat and Vulnerability Management, and the outline's tasks include "Identify and assess the AI threat landscape" and "Design and implement testing and vulnerability management of AI solutions". The outline does not say which catalog of threats to use; OWASP's list was written for exactly that job in applications built on language models.

ISACA's guide says its questions are "developed with the intent of measuring practical knowledge and the application of general concepts and standards". So treat the list as vocabulary for scenarios, not numbers to recite. When a scenario describes an assistant that forwards customer records because of instructions hidden in an email, it helps to see two entries at once, prompt injection and excessive agency, and to know that the stronger control lives in the second: what the assistant is allowed to do.

What the OWASP Top 10 for LLM Applications is

The list comes from the OWASP GenAI Security Project, which calls the 2026 edition "the latest community-driven guide to the most critical security risks facing applications powered by large language models". It is written for "developers, architects, security teams, and CISOs", it is a free PDF, and it is licensed under Creative Commons CC BY-SA 4.0. The editions so far are 1.0 in August 2023, 1.1 in October 2023, the 2025 edition in November 2024 and the 2026 edition in August 2026.

The 2026 document runs to 122 pages. Each of the ten entries has the same four parts: a description, common examples of the risk, prevention and mitigation strategies, and example attack scenarios. A new appendix replaces the per-entry lists of related frameworks with one mapping of all ten entries to nine external frameworks and taxonomies, among them MITRE ATLAS, NIST AI 600-1 and the NIST AI RMF.

One boundary, OWASP says, "matters more every year": "This list owns the risk when the model is a component inside your application." When the model becomes an actor, with tools it can call, memory it carries between sessions, and consequences downstream, the risk moves to OWASP's Top 10 for Agentic Applications, and the 2026 edition tells you to read the two together.

The 2026 list, and the 2025 numbers

"The order moved more than in past years," the 2026 edition says. Excessive Agency "climbed to third, the most consequential move on the list", because the vote and the incident record both point to agentic deployments as where the damage is landing. Unbounded Consumption "rose four places". Improper Output Handling "fell the furthest, from fifth to tenth". Prompt Injection and Sensitive Information Disclosure held first and second.

Four entries also grew without changing their names. Prompt Injection now covers cross-modal attacks that hide instructions in an image or an audio track; Supply Chain covers a promoted model artifact that is not what it claims to be; Data and Model Poisoning absorbs fine-tuning subversion; and Improper Output Handling spans the insecure code that assistants generate.

How the 2026 order was decided

For the first time, the ranking was checked against a record of what has gone wrong. The project leads "pulled together a corpus of 7,714 real incidents" from public vulnerability databases and an AI-harm database, and sorted the 6,639 that carried enough detail. "The community vote carries three-quarters of the weight. The incident data covers the remaining quarter."

Two results stand out. Ranked by the raw incident record, prompt injection "falls out of the top 10 entirely". The leads read that as a defense effect: teams fight injection hard, so fewer clean exploits reach public databases, and it keeps first place on the vote. Misinformation went the other way. Voters placed it near the bottom, the incident record near the top, and the leads single it out as the entry to slow down on.

The ten risks, grouped by what fails

Ten entries are a lot to hold one at a time. Grouped by the failure each represents (our grouping, not OWASP's), they come down to five.

When input becomes instruction: Prompt Injection (LLM01)

A prompt injection happens when input to the model changes its behavior in ways the developer did not intend, whether that input is typed by the user or arrives through retrieved content, tool output, an image, audio or the model's own memory. The root problem is that a model treats instructions and data as tokens on one stream, so there is "no clean equivalent to parameterized queries". The 2026 edition counts injection through retrieved documents here, not under vector weaknesses.

The project leads put the consequence plainly: "Since you cannot close that surface, you build for the day it is used against you." OWASP's controls therefore limit what an injected model can do. Keep credentials and the power to change state in application code rather than in the model, grant least privilege, pass external content through a separate, labeled channel, require human confirmation before privileged or irreversible actions, and test against adaptive attackers. For agents it adds the Rule of Two: an agent that holds untrusted input, sensitive data and the power to change state or communicate externally all at once "needs per-action human approval".

When output becomes action: Excessive Agency (LLM03) and Improper Output Handling (LLM10)

Excessive Agency is the vulnerability that lets unexpected, ambiguous or manipulated model output trigger damaging actions. OWASP traces it to "excessive functionality", "excessive permissions" or "excessive autonomy": tools the task does not need, access broader than the task requires, or actions taken without a check. The controls read like a least-privilege checklist: minimize tools, their functions and their permissions; avoid open-ended tools such as running a shell command; execute tools in the user's own context; require user approval for high-impact actions; and "Implement authorization in logic rather than relying on an LLM to decide if an action is allowed or not."

Improper Output Handling is the other half: model output passed downstream without enough validation, sanitization or handling. In a browser it can become cross-site scripting; on a backend, server-side request forgery, privilege escalation or remote code execution. OWASP's first control is to "Treat the model as any other user, adopting a zero-trust approach", followed by context-aware output encoding, parameterized queries and a strict Content Security Policy. The two entries are kept apart: sanitizing output is this entry's control, and OWASP says it is not a root control for excessive agency.

When the model leaks: Sensitive Information Disclosure (LLM02), Hidden Context Exposure (LLM08), Vector and Embedding Weaknesses (LLM09)

Sensitive Information Disclosure is the exposure of confidential, regulated, privileged or proprietary data through an unauthorized channel, and the 2026 edition stresses that the channel is not only the answer: tool-call arguments, reasoning traces, retrieved chunks, logs and embeddings are all disclosure surfaces. It sorts disclosure into four phases, training-time, inference-time, pipeline-time and observation-time. Among its controls: send external providers only the fields a task needs, "Authorize before retrieval", never store secrets or regulated data in system prompts, and scrub logs and traces.

What the 2025 list called System Prompt Leakage, the 2026 edition calls Hidden Context Exposure, "a broader framework for the same failure". It is "the unauthorized extraction, inference, or reconstruction" of what an application places in the model's context but never shows the user: the system prompt, developer instructions, retrieved policy text, and the schemas of the tools the model can call. Practitioners "should design under the assumption that hidden context is discoverable". Keep credentials, connection strings and tokens out of it, and never rely on it alone for authorization or content filtering. Severity tracks what is inside: harmless instructions are informational, embedded credentials are high, and a leak that chains to remote code execution or broad data exfiltration is critical.

Vector and Embedding Weaknesses are the risks of any system that uses similarity search to decide what the model sees, retrieval-augmented generation (RAG) above all. OWASP sums them up in one line: "poisoning makes the system wrong, inversion makes it leak, jamming makes it silent, and access-control failure makes it indiscriminate". The first control is access control enforced inside the index query, "not as a post-retrieval filter", with data segregated by trust tier and anomalies watched at ingest and retrieval.

When the model is wrong or costly: Misinformation (LLM07) and Unbounded Consumption (LLM06)

Misinformation is output that is incorrect, incomplete, unsupported or misleading yet credible enough to drive a decision or an action. "The core risk is that the incorrect output is trusted and acted upon." In agentic systems, that means an agent acting on a false state: a backup reported done that never ran, a customer marked verified who is not. The controls move verification into the workflow: ground claims in authoritative sources, separate generation from execution and "verify claims before acting", check a tool call's preconditions and the current state before it runs, and use verification signals rather than confidence alone. OWASP also draws the borders: running unsafe generated code belongs to Improper Output Handling, and attackers registering hallucinated package names belong to Supply Chain.

Unbounded Consumption covers uncontrolled inference, through which attackers can "disrupt service availability, inflict unsustainable financial costs, or steal intellectual property through model cloning". Its defining trait is cost asymmetry: a cheap request can trigger expensive computation, and reasoning models, multimodal models and agents that turn one request into many make it worse. The 2026 edition is plain that "Traditional request-rate limiting alone is no longer sufficient", and adds token-aware cost controls, hard spending caps and circuit breakers that halt runaway agents.

What you inherit: Supply Chain (LLM04) and Data and Model Poisoning (LLM05)

Supply Chain covers the integrity of what you did not build: third-party pre-trained models, datasets, adapters made with fine-tuning techniques such as LoRA, conversion pipelines and deployment platforms. OWASP's controls include vetting data sources and suppliers, red-teaming third-party models for your own use cases before adopting them, keeping a signed, up-to-date inventory of components in a software bill of materials, and using models only from verifiable sources.

Data and Model Poisoning is the manipulation of data or model artifacts, by "an adversary (or unsafe process)", that plants harmful behavior, bias or an exploitable weakness. It can happen at pre-training, fine-tuning, embedding creation, retrieval or model distribution, and it is costly to undo, because the cure can mean "data revalidation, retraining, model replacement, or pipeline redesign". The controls are lineage tracked in an ML bill of materials, strict validation of incoming data, data version control, human checks on automated retraining, and continuous red teaming for hidden triggers.

Putting the list to work as a security manager

A developer uses the list to fix code; a manager uses it to make sure nothing is missed and that someone owns each risk. Four uses we suggest:

1. A threat-modeling checklist. Walk every LLM application through the ten, alongside STRIDE for structural threats and MITRE ATLAS for adversary techniques, so no AI-specific failure goes unnamed.
2. Review questions. Turn entries into questions for a design review or a vendor. What sits in the hidden context, and is any of it a secret? Does retrieval check permissions inside the query? What can the agent do without a human, and what are its spending caps? Is model output encoded before it reaches a browser, a database or a shell?
3. A test plan. The 2026 edition asks for tests "against adaptive attackers who have read the deployed defense", so red-team findings should name the entries they exercised.
4. A bridge to other frameworks. The appendix maps the ten entries to nine frameworks, NIST AI 600-1, the NIST AI RMF and MITRE ATLAS among them, which helps when the risk register and the auditors speak those languages. Our guide to the NIST AI RMF for AAISM candidates covers the NIST side.

When a model starts acting on its own, add OWASP's agentic list to the checklist; by OWASP's own account, neither list covers that ground alone.

How the list meets the AAISM outline

ISACA's outline does not mention OWASP, so this mapping is ours. It shows where each entry's ideas sit among the outline's topics:

Learning the OWASP list with QualExam

Our AAISM course teaches the list in lesson 2B/03, on GenAI and LLM threats, using the 2026 edition, with 28 practice questions and 33 flashcards that drill each risk and the control that answers it. The ideas come back in the lessons on security architecture, secure design patterns, data governance and runtime guardrails. The first topic, AI governance and regulation, opens in full with a free account, so you can try the lessons and questions before paying, and full access is a single payment, with nothing to renew. For how the topics fit together, see the AAISM exam content outline explained.