OWASP Top 10 LLM Security Risks 2026
The OWASP Top 10 for LLM Applications just got its 2026 refresh, and the reordering is bigger than any year since this list started.
A few things jumped out as worth highlighting:
👉 Excessive Agency jumped to No. 3. This was the biggest move on the list. Give an agent tools, memory, and autonomy, and the damage from a bad output stops staying in the chat window.
👉 Unbounded Consumption climbed four spots. This is where attackers are able to trigger expensive computation for cents/pennies. Security teams are finally pricing that in, and 'denial of wallet' has now become a real budget line item (rather than a joke).
👉 Improper Output Handling fell from 5th to 10th, which was the steepest drop on the list. This is not necessarily because it stopped mattering (it hasn't), its just because other risks caught up faster.
👉 Prompt Injection is still at No. 1. No surprise there as models still can't tell instructions from data, they're all just tokens on the same stream, so there's still no clean fix, only mitigation.
👉 System Prompt Leakage got renamed to Hidden Context Exposure, which is just a wider net for the same underlying problem, information that was never supposed to be visible, and usually is anyway.
The ten categories have one clear theme, which is that the risk moves to wherever the model has the most freedom to act.
