currently_learning / owasp-llm-top10
Notes on the OWASP Top 10 for LLM Applications, 2026 edition.
OWASP Top 10 for LLM Applications
2026 Edition
Published by the OWASP GenAI Security Project, this is the community-driven reference for the most critical security risks in LLM-powered applications. It maps familiar failure modes — injection, broken access control, unsafe deserialization — onto how they actually show up once a large language model sits in the request path: untrusted text that gets treated as instructions, tool calls with too much reach, and outputs that downstream systems trust a little too much. The list below isn't ranked by severity — LLM10 can matter as much as LLM01 depending on what you've built — so it's worth treating as a full threat model rather than a checklist to clear top-down.
risks --list ./owasp-llm-top10/
Untrusted text — typed by a user or hidden in a document, webpage, or tool result the model later reads — gets interpreted as an instruction instead of data, letting an attacker override the application's intended behavior. Covers both direct injection and indirect injection via content the model ingests.
The model exposes data it shouldn't: personal information memorized during training, secrets embedded in a system prompt, private documents pulled in through retrieval, or details inferred from earlier turns in the conversation.
A compromise anywhere upstream — model weights, a fine-tuning dataset, a plugin, or a third-party library — runs inside the application's trust boundary. A backdoored open-weight model can carry hidden triggers that only fire on inputs the attacker knows in advance.
Attackers plant adversarial examples in training or fine-tuning data so the model behaves normally under evaluation but produces attacker-chosen output for a narrow set of inputs only they know about.
Downstream code trusts LLM output the way it would trust sanitized input, opening the door to SQL injection, XSS, command execution, and SSRF once that output is passed straight into a query, a shell, or a browser. The model has no security model of its own.
An agent is handed more permissions, tools, or autonomy than the task actually needs. When that happens, a successful prompt injection doesn't just corrupt a response — it can trigger irreversible real-world actions.
The instructions, persona rules, tool documentation, and any embedded credentials in a system prompt get extracted by an attacker — handing them a map of the application's guardrails and internals.
RAG pipelines bring their own attack surface: poisoned embeddings, retrieval that crosses tenant boundaries it shouldn't, and inversion attacks that reconstruct approximate source text from exposed vectors.
The model states false information with total confidence. When that output feeds an automated decision or an irreversible action, a hallucination stops being an accuracy problem and becomes a security incident.
Long prompts, runaway generations, tool-call loops, or embedding floods let an attacker drive compute and API spend far beyond normal usage in a very short window — a denial-of-wallet problem as much as denial-of-service.