The OWASP GenAI LLM Top 10 2026: What Actually Changed

The OWASP GenAI LLM Top 10 2026 came out August 3, 2026, and it’s a real new edition, not a relabeling of the 2025 v2.0 list. The change that matters most is in the method. For the first time, the expert-panel rankings were cross-checked against a database of roughly 10,000 real-world AI security incidents, which moves the list from “what experts are afraid of” toward an evidence-weighted threat model [1][2][3].

The headline finding is that the risk center of gravity shifted from input and parsing flaws toward autonomy and resource control. Prompt injection holds #1 for a third straight year, but the big movers are all agentic-era concerns. Excessive Agency jumps #6→#3, Unbounded Consumption #10→#6, and Misinformation #9→#7, while Improper Output Handling collapses #5→#10 [2][3][4].

The re-ranking sits on a year of demonstrated agentic incidents: the AutoJack single-page Remote Code Execution (RCE) against AutoGen Studio, a wave of Model Context Protocol (MCP) tool-poisoning and backdoored MCP servers, and the first financially-motivated in-the-wild indirect prompt injection [8][10][11][12]. The practical read is a reframe: prompt injection is the trigger, but excessive agency is the blast radius [7][30].

The edition-by-edition delta

The taxonomy has four published states: v1.0 (August 1, 2023), v1.1 (October 16, 2023, mostly editorial), Version “2025” (released November 18, 2024 but titled 2025 — the edition name is the target year, not the release year), and Version “2026” (released August 3, 2026, versioned v1.0) [25][26][1][2].

The 2023 baseline was built by ~500 experts via expert voting, with no incident-data grounding [25][27]. The 2025 edition removed Insecure Plugin Design and Model Theft, added System Prompt Leakage and Vector & Embedding Weaknesses, and renamed several entries [26][27]. The 2026 list:

Figure 1 — The 2026 bump chart. Autonomy and resource-control risks rise; Improper Output Handling drops the most.

Why these moves

• Excessive Agency #6→#3 (▲+3) is the sharpest agentic signal. Agents now browse, call tools, and act, so an over-permissioned agent is a first-class, top-tier risk. Mitigation is tightly scoped permissions plus continuous behavioral monitoring [2][7].
• Unbounded Consumption #10→#6 (▲+4) — the DoS-and-cost-abuse class now includes “tool-call storms.” Practitioners call it “easiest to mitigate once you decide to,” because it’s conventional rate-limiting and circuit-breaking [7][30].
• Misinformation #9→#7 (▲+2) — elevated because a wrong-but-confident answer can drive irreversible actions, including the “supply-chain attack via hallucination”: an attacker registers a package name the model hallucinated [7][30].
• Improper Output Handling #5→#10 (▼−5) is the largest drop. It’s the least “AI-mystical” item — every case maps to a conventional web vulnerability reached through model output — so its demotion reads as “no longer novel,” with the skills already in-house [7][30].
• The only rename: System Prompt Leakage → Hidden Context Exposure, scope expanded beyond the system prompt to tool schemas, retrieved policy text, refusal/format rules, and permissions disclosure [2][5].

What the methodology change signals

The 2023 and 2025 lists were ranked mostly by expert voting. The 2026 edition validated those votes against the ~10,000-incident database. Steve Wilson (OWASP GenAI co-chair) is quoted as saying “We learned more from the disagreements than from where they agreed,” and practitioner fear did not always match the incident data [3]. The starkest example of that gap: ranked by raw incidents alone, prompt injection “wouldn’t even make the top 10,” yet it holds #1 because mature teams already suppress it so effectively that clean exploits rarely reach public incident databases [4][3].

The technical mechanism

The architectural root of prompt injection is the control-plane/data-plane collapse. Traditional systems keep a hard line between deterministic control logic (SQL templates, shell commands) and untrusted user data, enforced through parameterization. Transformers erase that boundary: the system message, tool definitions, retrieved documents, and user input all arrive as equal tokens in one context window, so nothing can be structurally marked “instruction” versus “data” [17]. This is why OWASP states “it is unclear if there are fool-proof methods of prevention,” and why the mitigations are architectural rather than a single patch [5].

Three mechanism-level distinctions matter:

• Direct vs. indirect injection is a trust-origin difference, not a mechanism difference. Direct comes through the user prompt; indirect plants instructions in external content (webpages, PDFs, emails, MCP tool descriptions, RAG corpora, memory, code repos) the agent ingests during normal operation. Indirect is the dangerous agentic variant — invisible and riding trusted data flows [6][16].
• Jailbreaking is a subclass of prompt injection, not a sibling — inputs that cause the model to disregard its safety protocols entirely [5].
• Insecure output handling (LLM10) is the inverse mechanism: model output must be treated as untrusted input. Unvalidated output passed to exec/eval/shell gives RCE; generated JavaScript/markdown returned to a browser gives XSS; crafted SQL gives destructive queries. Apply user-input output-discipline: parse, don’t concatenate; structured outputs; sanitize markdown [6][30].

The agentic shift: injection moves from output to action

In a chatbot, a poisoned context produces a wrong sentence. In an agent, it steers tool calls, code execution, and credential use — the blast radius is a capability, not text [15]. Three mechanisms drive the re-ranking:

• Tool poisoning is indirect prompt injection at the tool-metadata boundary. MCP clients receive tool definitions (name, description, inputSchema) from servers and pass them into the LLM context without validation. Because the description is authoritative to the model, a compromised server can embed hidden instructions that redirect behavior before the tool is called. A threat model ranked tool poisoning the most prevalent, highest-impact client-side MCP vulnerability (DREAD ≈ 46.5/50), with attack success up to 72.8% and refusal rates under 3% [16]. MCP is thus a new tool-authorization boundary — the schema itself must be validated and allowlisted, not just the tool’s execution [16].
• Excessive agency is the multiplier that converts context injection into compromise: an agent holding session credentials, API tokens, or a connected identity “the attacker can ride” turns a single injected instruction into a privileged action. Mitigation: give the application its own API tokens, handle functions in code, enforce least privilege, require human approval for high-risk actions [5][7].
• Memory poisoning extends injection lifetime across sessions — an attacker plants false facts/instructions in episodic or semantic memory today, and the agent retrieves them weeks later during a high-stakes task. Defense is architectural: separate memory stores, independent access controls, TTLs, write-provenance logging [15][6].

Agent Zero Trust = least privilege extended to every ingestion surface. No content the model consumes is implicitly trusted — webpages, PDFs, MCP metadata, RAG, memory, code — and the agent’s permissions, tools, and communication are narrowed per task and revoked at completion. The OWASP-native formalization is Least Agency in the Agentic Top 10: “autonomy is a feature that should be earned, not a default” [7][9][15][24][29].

The incidents that drove the re-ranking

AutoJack — a single web page RCEs the host running an AI agent

Microsoft’s June 18, 2026 disclosure showed that one malicious page, rendered by an AutoGen agent’s browsing tool, could execute arbitrary code on the developer’s machine with zero further interaction [8]. The chain exploited three weaknesses in AutoGen Studio’s MCP WebSocket control plane: (a) an origin allowlist trusting localhost that any local headless browser satisfies; (b) authentication middleware that opted /api/mcp/* out, so no token was required; and (c) a server_params parameter base64-decoded and passed verbatim as command/args with no executable allowlist (OS command injection). The agent is a confused deputy crossing the localhost trust boundary.

The lesson OWASP-adjacent commentary drew: localhost is no longer a trust boundary when an agent can browse untrusted content and reach privileged local control planes [8][9]. The flaw was confined to pre-release builds and fixed before stable release; no CVE was assigned and in-the-wild exploitation was never confirmed — so AutoJack is a strong proof of the class, not evidence of broad exploitation [8][9].

MCP supply-chain and tool-poisoning incidents

• The postmark-mcp backdoor (Sept 25, 2025) was the first tracked malicious MCP server on npm: a hidden BCC to an attacker domain silently exfiltrated every email sent through it — passwords, invoices, customer PII — with no human-in-the-loop. Removed only after detection [10].
• Tool poisoning turning legitimate tools into exfiltration channels: Invariant Labs demonstrated a malicious MCP server poisoning a benign “random fact of the day” tool to bulk-ship hundreds of messages to an attacker phone number, bypassing DLP; a companion finding showed a malicious GitHub issue hijacking an agent to pull private repo contents including salary data into a public PR via one over-privileged token [11].
• A systemic MCP STDIO design flaw — configuration-to-command execution without sanitization — affected 150M+ downloads and produced 30+ disclosures and ~10 CVEs (RCE on Letta, unauthenticated takeover on LangFlow, Flowise filter bypass). Adjacent CVEs (e.g., mcp-remote CVE-2025-6514, Common Vulnerability Scoring System (CVSS) 9.6) reinforced the pattern: shared adapters propagate one design flaw across thousands of deployments [11][13].

In-the-wild indirect prompt injection goes financial

Unit 42 (Palo Alto Networks) reported the first real-world malicious indirect prompt injection designed to bypass an AI-based product ad-review system, plus 22 in-the-wild payload-engineering techniques and a severity taxonomy running from anti-scraping up to critical (data destruction, DoS, system-prompt leakage, unauthorized transactions) [12]. This moves indirect prompt injection from proof-of-concept and opportunistic pranks to financially-motivated attacks on real review/moderation pipelines.

The empirical counterweight

MITRE ATLAS records both realized and attempted-but-failed injections (e.g., a live malware sample with embedded injection ineffective against tested models) [13][19]. Demonstrated PoC severity consistently exceeds observed in-the-wild impact so far. The attack class is real and growing, but “most dangerous” is a forward-looking risk posture, not a current-incident count.

The crosswalk: ATLAS, CWE, NIST, and the Agentic Top 10

The 2026 edition explicitly maps each risk to NIST, MITRE ATLAS, CWE, and the OWASP Top 10 for Agentic Applications [1]. The division of labor across the family:

Figure 2 — The taxonomy family. The 2026 LLM list positions itself as one node among the Agentic Top 10, MITRE ATLAS, NIST, CWE, and AISVS.

The operative crosswalk resolves LLM items to ATLAS techniques: LLM01 → AML.T0051.000/.001 (direct/indirect) + AML.T0054 (jailbreak); LLM02 → AML.T0057 + AML.T0024; LLM03 → AML.T0010; LLM04 → AML.T0020; LLM05 → AML.T0067; LLM06 → AML.T0015 + AML.T0053 (tool invocation); Hidden Context Exposure → AML.T0056 (system prompt extraction); LLM10 → AML.T0029 + AML.T0034 (cost harvesting) [19][13]. Caveat: this per-item technique table is community-maintained and pinned to 2025 item names; item-level IDs were not re-verified individually in every 2026 entry, though LLM08’s own “Related Frameworks” table maps to AML.T0051.000 and AML.T0057 [2][19].

Consistency between the two OWASP lists

The Agentic Top 10 (ASI01–ASI10, published December 9, 2025) overlaps the GenAI list by design; OWASP publishes the overlap in the Agentic document’s appendix [1][7]. Roughly five mechanisms appear under different names: Agent Goal Hijack (ASI01) ↔ Prompt Injection + Excessive Agency; Tool Misuse (ASI02) ↔ LLM06/LLM05; Supply Chain (ASI04) ↔ LLM03; Memory/Context Poisoning (ASI06) ↔ LLM04/LLM08; Unexpected Code Execution (ASI05) ↔ LLM05 [7][19]. ASI01 merges injection with excessive agency, and autonomous multi-step execution amplifies impact beyond single-response attacks [15].

Items unique to the Agentic list (no direct LLM analog): ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation, ASI10 Rogue Agents, and largely ASI03 Identity & Privilege Abuse. GenAI-unique: Sensitive Information Disclosure, Hidden Context Exposure, Misinformation, Unbounded Consumption [7][19].

Agentic identity and privilege

The reframing at the heart of agentic security: agents are principals, not proxies. The risk model shifts from “did the model produce correct output” to “under whose authority did which agent do what, and could it be revoked” [7][28].

• ASI03 — Agent Identity & Privilege Abuse sits at #3 in the Agentic Top 10, framed as “the blast radius for every other agent risk.” Agents are identity aggregation points: an agent operates with the combined authority of every token, key, and credential assigned to it — compromise one agent and you inherit all its permissions. A 2025 figure cited is an 82:1 machine-to-human identity ratio: agents/APIs routinely hold more access than the humans they serve [28].
• The canonical credential-inheritance attack is the Salesloft Drift breach (August 2025): attackers stole OAuth refresh tokens from a single chatbot integration and reached 700+ organizations in ten days. “The tokens were the identity. No passwords, no MFA bypass, no CVE” [28].
• A five-vector taxonomy of identity abuse: I1 Credential Inheritance, I2 Token Theft & Reuse, I3 Privilege Accumulation, I4 Inter-Agent Trust Abuse, I5 Semantic Privilege Escalation (the agent exceeds its instructions while staying within its permissions) [28].
• The confused deputy at scale: the 1988 confused-deputy problem becomes attacker → agent → {Email, CRM, DB, Cloud} at machine speed, with a probabilistic, adaptive deputy [28].
• The “Golden Rule” of delegation: when agent A delegates to agent B, authority can only decrease — the receiving agent must never exceed the delegating agent’s permissions, preventing privilege escalation in delegation chains [9][28].

Figure 3 — Agent Zero Trust’s three control families. Identity gives each agent a scoped cryptographic identity; Authority enforces least privilege at the tool boundary; Evidence attributes every action and revokes the whole delegation chain.

Three control families summarize the practical posture: Identity — per-agent cryptographic identity, no shared service accounts; Authority — least privilege, task-scoped, short-lived credentials, enforcement at the tool/infrastructure boundary (not in the prompt, since injection can override instructions); and Evidence — every action attributed to agent + user + task, with revocation that invalidates the whole delegation chain, not just the leaf token [7][9][28]. Human-in-the-loop is required for irreversible or high-impact actions [5][7]. The closest formal “zero trust for agents” standards are the Cloud Security Alliance Agentic Trust Framework (February 2026) and the OWASP Agentic Top 10’s Least Agency principle [24][7][15].

Where the sources disagree

1. Is the 2026 edition real, or a relabel? Resolved in favor of “real.” Some secondary sources and a stale repo README badge (still pointing at the 2025 v2.0 announcement) fed the impression that the current edition is only “2025 v2.0.” The primary repo’s separate 2025/ and 2026/final/ folders, the versioned v1.0 asset, the dedicated 2026 sprint plan, and two independent outlets confirm the August 3, 2026 edition [1][2][3][4]. The lesson: this field’s documentation lags its releases, and a vendor blog re-labeling 2025 v2.0 as “2026” is a real hazard when searching.

2. Is prompt injection really the #1 risk, given incidents say otherwise? The disagreement is internal to OWASP itself. Ranked by raw incidents, prompt injection wouldn’t crack the top 10 [4]; it is #1 on practitioner perception because teams suppress it so effectively that few clean exploits reach incident databases [3][4]. The skeptic reads this as proof the list is perception-driven (“art, not science”) [18]; the practitioners’ rejoinder is that perception is the right prior when pricing the residual risk of an unsolvable class [3][30]. The 2026 methodology at least surfaces the gap explicitly.

3. Can prompt injection be solved, or is it an impossibility? The Architect view is “unsolvable in principle, mitigate architecturally” (control-plane/data-plane collapse) [5][17]. A 2026 impossibility-argument paper goes further, arguing under Contextual Integrity that an adversary can always construct a context where a blocked flow looks legitimate, with injection classifiers performing near chance (AUROC 0.43–0.59) on contextual manipulation [20]. The counterpoint is that “unsolvable” ≠ “unmanageable”: blast-radius reduction, least privilege, and human-in-the-loop are effective even if the class can’t be patched [5][7][30]. Ranking an unsolvable item #1 while telling teams it can’t be fixed sits uneasily with “actionable prioritization.”

4. How severe are the agentic incidents — demonstrated vs. exploited? There’s a systematic gap between demonstrated PoC severity (AutoJack full host RCE, the MCP 150M-download supply-chain flaw) and observed in-the-wild impact (much opportunistic, some financial). ATLAS records attempted-but-failed injections [13][19]. Pessimists read an incident wave about to break; optimists read security working so far. Neither view is settled by the data.

5. Does the ATLAS/CWE crosswalk represent meaningful alignment or rubber-stamping? A peer-reviewed AMCIS 2026 study mapped 52 ATLAS case studies against the GenAI Top 10 and found “substantial but uneven alignment,” identifying three gap types: OWASP categories underrepresented in ATLAS, modality-specific vulnerabilities, and adversary-preparation behaviors ATLAS captures that OWASP does not [22]. The crosswalk is a useful index, not proof that either taxonomy covers the risk space completely.

The devil’s advocate

A few reasons this report may be overstated:

• The re-ranking narrative may over-read the numbers. The list is not a severity scale — the number is “an address, not a verdict” [21]. “Excessive Agency went #6→#3” sounds like a measured shift, but OWASP’s own methodology concedes the ordering blends expert opinion with skewed vendor-submitted data [3][18]. Treat the bump chart as directional signal, not measurement.
• The taxonomy proliferation is itself a cost. Now there are two OWASP AI Top 10s plus ATLAS plus NIST plus AISVS [2][21][22]. Teams can taxonomize themselves into compliance-picking rather than risk reduction.
• Several details rest on single or weaker sources. Per-item Common Weakness Enumeration (CWE) references come from a community crosswalk, not re-verified at cwe.mitre.org [19]. The 82:1 ratio is vendor-sourced [28]. Severity grades for some items come from a third-party annotated walkthrough [30]. AutoJack was never observed in the wild and was confined to pre-release builds [8][9]. None are fabrications, but not all are independently re-verified from primary sources.
• The “incident-driven” framing is partly rhetorical. The incidents are recent and many are proofs-of-concept rather than widespread exploitation; the re-ranking may over-index on a few attention-grabbing PoCs (AutoJack, the MCP STDIO flaw).
• Counterfactual: if agentic adoption had not surged in 2025, would Excessive Agency have jumped to #3 on the merits of its incident record? Probably not — the re-ranking is as much a response to where the industry is deploying as to what has demonstrably broken.

These caveats don’t overturn the central finding — the taxonomy genuinely re-centered on autonomy and resource control — but they argue for reading the precise rank numbers as a rough, forward-looking signal rather than an empirical measurement.

Conclusion

The OWASP GenAI LLM Top 10 2026 is the first edition built with an incident-data backbone, and its most honest output is the discovery that the field’s risk center of gravity shifted toward what agents can do, not what inputs can say. Prompt injection remains #1 because it is the unsolvable trigger; Excessive Agency, Unbounded Consumption, and Misinformation rose because they are the blast radius.

Prompt injection is the trigger; excessive agency is the blast radius. Scope the agent, isolate its identity, enforce least privilege at the tool boundary rather than in the prompt, and treat every surface the model consumes — and every output it produces — as untrusted.

The taxonomy won’t make prompt injection solvable; it will tell you where to spend your limited defense budget.

References

1. OWASP, “OWASP GenAI LLM Top 10 2026” — genai.owasp.org
2. GenAI-Security-Project, “GenAI-LLM-Top10” (repo, 2026/final) — github.com
3. SD Times, “Prompt Injection tops 2026 OWASP GenAI/LLM Top Ten” (Aug 4, 2026) — sdtimes.com
4. Infosecurity Magazine, “Prompt Injection Remains Biggest LLM Risk, Despite Limited Incidents” — infosecurity-magazine.com
5. OWASP, “LLM01:2025 Prompt Injection” — genai.owasp.org
6. OWASP, “LLM02 Insecure Output Handling” — genai.owasp.org
7. OWASP, “Top 10 for Agentic Applications 2026” — genai.owasp.org
8. Microsoft Security Blog, “AutoJack: How a single page can RCE the host running your AI agent” (Jun 18, 2026) — microsoft.com
9. Cloud Security Alliance, “AutoJack research note” — cloudsecurityalliance.org
10. Snyk, “Malicious MCP Server on npm postmark-mcp Harvests Emails” — snyk.io
11. Invariant Labs, “MCP Security Notification: Tool Poisoning Attacks” — invariantlabs.ai
12. Palo Alto Networks Unit 42, “Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild” — unit42.paloaltonetworks.com
13. MITRE ATLAS — atlas.mitre.org
14. MCP, “Security Best Practices” — modelcontextprotocol.io
15. Trent AI, “What Changed From the LLM Top 10” — trent.ai
16. arXiv, “Model Context Protocol Threat Modeling: Tool Poisoning” — arxiv.org
17. Chris Beckman, “When data is code” — chrisbeckman.dev
18. Daniel Miessler, “OWASP Top 10 Lists are Art, Not Science” — danielmiessler.com
19. GenAI-Security-Crosswalk, “LLM_MITREATLAS.md” — github.com
20. Abdelnabi & Bagdasarian, “AI Agents May Always Fall for Prompt Injections” — arxiv.org
21. A10 Networks, “OWASP Now Has Two AI Top 10s” — a10networks.com
22. Ogbanufe & Agrawal, “Governing AI Threats Through Adversarial Threat Frameworks” (AMCIS 2026) — aisel.aisnet.org
23. NIST, “AI 100-2e2023: Adversarial Machine Learning” — nist.gov
24. Cloud Security Alliance, “The Agentic Trust Framework” (Feb 2026) — cloudsecurityalliance.org
25. OWASP, “Top 10 for LLM Applications 2023 v1.0 PDF” — owasp.org
26. OWASP, “Top 10 for LLM Applications v2025 PDF” — owasp.org
27. Lorikeet, “OWASP Top 10 LLM 2025: What Changed” — lorikeetsecurity.com
28. Adversa AI, “OWASP ASI03: Identity & Privilege Abuse in AI Agents” — adversa.ai
29. Aikido, “OWASP Top 10 for Agentic Applications (2026)” — aikido.dev
30. Wraith, “The OWASP Top 10 for LLM Applications, Annotated (2026 Edition)” — wraith.sh