OWASP LLM Top 10 2026: the model will be fooled, the question is what breaks

OWASP’s 2026 LLM Top 10, and the shift most of the coverage will miss

The OWASP GenAI Security Project published the 2026 edition of its Top 10 for LLM Applications. Prompt Injection stayed at number one. Sensitive Information Disclosure stayed at number two. Read the headlines and you would conclude that not much moved.

Something did move, and it is not in the rankings. The project leads open by telling you to stop trying to build a model that cannot be fooled, and to build the system around it so that when the model is fooled, nothing important breaks.

That is a change in what the job is. For two years the industry has been optimizing the model. This list says optimize the containment. It reframes the exercise as blast radius control rather than perfect prevention.

I agree with it. I also think it carries a consequence the list does not state out loud, which I will come back to at the end.

Three shifts worth your attention

1. Misinformation climbed on evidence, against the vote

This is the first edition where data influenced the ordering. Practitioner voting still carried 75 percent of the weight. The remaining 25 percent came from 6,639 real incidents pulled from public vulnerability databases and an AI harm database.

That quarter weight mattered most in one place. Voters put Misinformation near the bottom. The incident record put it near the top. It moved up two places.

Sit with that gap, because the gap is the finding. The people doing this work every day are calibrated to attacker-driven risk: injection, leakage, poisoning. The incident record says the most expensive failures are the ones with no attacker in them at all. The model was simply wrong, and something downstream believed it.

The project leads are precise about why this is now a system-level failure rather than a content problem. Model output drives tool calls, generates code, infers system state, authorizes actions, and coordinates across agents. Wrong output at the top of that chain does not stay output. It becomes a decision.

2. The damage moved from what the model says to what the model does

Excessive Agency climbed to third, and here the vote and the data agreed: agentic deployments are where the damage is landing. Unbounded Consumption rose four places on practitioner weighting, as resource and cost exhaustion became a line item people can see on an invoice.

Put those two next to each other and the picture is clear. The failures landing hardest are not embarrassing outputs. They are actions taken and money spent.

The good news, and I do not hear enough people saying it: most of this is not new work. Least privilege. Scoped credentials with short lifetimes. Rate and spend limits. A human gate on anything irreversible. AppSec has had these primitives for twenty years, and they transfer.

The bad news is the prerequisite. You cannot scope permissions for components you have not enumerated, and very few enterprises have a defensible inventory of which AI components in their estate can act, what those components can reach, and who stood them up.

3. The renames tell you more than the rankings

System Prompt Leakage became Hidden Context Exposure. Prompt Injection absorbed cross-modal attacks hidden in images and audio. Data and Model Poisoning absorbed fine-tuning subversion. Output Handling fell from fifth to tenth while widening in scope.

OWASP chose consolidation over new categories, which is the right editorial call. The direction it consolidates in is worth naming: the boundary that matters is the whole context, not the prompt field. Anything that reaches the context window is untrusted input, whatever format it arrived in and whoever put it there.

The boundary problem OWASP handed you

The 2026 edition is unusually clear about its own scope. It orders LLM security risks for the model as a component inside an application. The moment the model becomes an actor, with tools it can call, memory it carries between sessions, and consequences it sets in motion downstream, you are meant to move to the Agentic Top 10.

So do not inventory by list. Inventory by capability, and ask three questions of every AI component you find:

• Can it call tools or invoke other systems?
• Does it carry state between sessions?
• What can it write to, and what sits downstream of that?

Those three answers tell you which list governs, how large the blast radius is, and where containment has to sit. They are also questions you cannot answer without discovery, which is why the inventory comes before the controls rather than after them.

What I would do next quarter

Enumerate first. Models, agents, MCP servers, coding assistants with repository write access, and the ones a team stood up without telling security. Containment you cannot scope is a slide, not a control.

Classify by capability boundary, not by vendor and not by which OWASP list the component appears on.

Treat AI-suggested fixes as unverified input, including suggestions from your own tooling. Do not pass a fix direction into a patching agent unless you can vouch for it.

Instrument for silent failure. Change the acceptance test from “does the reproducer stop firing” to “does the vulnerable path still exist.”

Get a local number. Run the benchmark against bugs you have already fixed, in your own code, and stop planning against someone else’s average.

The consequence the list leaves implicit

Build the system around the model so that when it fails, nothing important breaks. Follow that instruction one step further, and it forces a structural question: who builds the system around the model?

It cannot be the model. A component cannot bound its own blast radius. And it should not be the vendor whose model produced the output, checked on the same model family and graded by the same weights, because the writer and the checker then share their blind spots.

This is not an argument about capability. Frontier models are improving quickly, and what they get wrong today they will get wrong less often in six months. It is an argument about structure, and structure does not improve with the next release. The auditor cannot be the author.

Mend.io does not generate your application code. We verify it, and we verify what your assistants wrote, whatever produced it.

Available across the Mend platform today: discovery and AI-BOM for the models, agents and AI components in your estate; model risk and agent configuration risk scanning; system prompt hardening; red teaming; and runtime protection, in-app or through a proxy. Alongside SCA, SAST, container and IaC scanning on the code itself.

The model will be fooled. Whether that matters is a function of what you built around it.

Sources: OWASP GenAI Security Project, Top 10 for LLM Applications 2026 edition, and Top 10 for Agentic Applications 2026.