OWASP Top 10 for LLM Applications 2026: What Changed, What Surprised Us, & What Matters

The 2026 OWASP Top 10 for LLM Applications grounds risk rankings in real incident data. By pulling thousands of documented failures and classifying them rigorously, OWASP has created evidence-based guidance that shows where practitioner priorities and actual harm align. As a member of the OWASP community, Laåsso is committed to this evidence-driven approach.

‍

The 2026 ranking surfaced some significant shifts:

‍

• Excessive Agency climbed to number three, reflecting the real stakes of agentic systems
• Unbounded Consumption rose by four positions, exposing how AI workloads can spiral beyond control
• Prompt Injection remains ranked highest, grounded in evidence about defense effectiveness
• Misinformation emerged as far more consequential than security teams initially recognized

‍

Every Role Has Something to Learn

‍

For CISOs and security teams, the rise of agentic risks means threat models must now account for tool delegation and autonomous decision-making. For compliance and governance leaders, Misinformation and Unbounded Consumption represent operational and regulatory exposure that traditional LLM monitoring leaves unaddressed. And for CIOs managing enterprise AI deployments, the ranking confirms the importance of runtime inventory, behavioral baselining, and adaptive protection.

‍

This post covers the complete Top 10 through Lasso's Discover-Assess-Protect framework. Each threat maps to the operational capabilities needed to defend it.

‍

‍

Threat 1: Prompt Injection (LLM01:2026)

‍

Prompt injection remains the top-ranked LLM risk because any external input can become an attack path. The impact depends on what the model can reach. A successful injection may expose sensitive data, alter outputs, or trigger unauthorized actions through connected tools and systems. In agentic environments, that can extend well beyond the chat interface.

‍

Detection is difficult because the payload may be embedded in content the user never sees. Defenses that focus only on visible prompts therefore cover only part of the attack surface.

‍

How Lasso Defends Against Prompt Injection

‍

• Discover: Inventory every path untrusted text can take into the application: user input, responses returned by tools, retrieved documents, and uploaded files.
• Assess: Run adversarial testing against the customer's own agent in an isolated environment, using the techniques attackers actually use.
• Protect: The input is first decoded, reversing any encoding or obfuscation used to conceal instructions. The recovered text is then classified for injection. Finally, that recovered content is evaluated for whether what it requests is harmful.

‍

Scanning the input as written misses anything concealed beneath an encoding, so a hidden payload passes inspection untouched. Decoding first removes that gap. Separating the two questions (was something concealed? and was the concealed content harmful?) also distinguishes ordinary encoded text from a deliberate attack, which is what keeps false-positive rates low enough to enforce in production rather than merely observe.

‍

Threat 3: Excessive Agency (LLM03:2026)

‍

Excessive Agency climbed from number six to number three. Here, practitioner judgment and incident evidence point in the same direction: agentic systems are where more consequential failures are emerging. The risk grows when models can choose tools and make changes without enough oversight.

‍

The underlying problem is that AI agents often have too many functions and permissions, as well as too much autonomy to use them. An agent may be able to delete data it only needs to read, or access systems beyond the scope of its task.

‍

The more authority an agent has, the more important least privilege, constrained tool access, and human approval become.

‍

Lasso’s Approach to Reining Agents in

‍

• Discover: Capture the agent's complete execution history: the user's request, the model's reasoning, every tool invoked, and every result returned. The full sequence, not only the final response.
• Assess: Exercise the agent against a library of adversarial scenarios spanning five categories of AI application. Each scenario specifies the violations it should produce, so results are scored rather than judged by inspection.
• Protect: Once the agent finishes, the complete sequence is evaluated against four reference points: what the application was designed to do, what the user requested, what the model actually did, and what external content reached it during execution. Misalignment between these is the signal. Findings also identify cause rather than symptom. External content redirecting the agent, the model exceeding its operating policy, and the model diverging from the user's request are three distinct failures requiring three distinct responses, and each finding cites the specific steps that evidence it.

‍

If all you’re looking at is individual inputs, everything can look legitimate: the request, the retrieved content, the tool call. But in the sequence, violation can emerge, when authorized steps combine into an outcome nobody would approve. Detecting it requires evaluating the run as a whole against a declared statement of intent.

‍

Threat 7: Misinformation (LLM07:2026)

‍

Misinformation shows the biggest belief-reality gap of all. Security teams ranked it near the bottom, but real-world incidents put it near the top. That makes it one of the more revealing findings in the 2026 report. Incorrect information can feed into business decisions or even other agents. Once a system treats that output as reliable, a factual error can become an operational one.

‍

Agentic systems raise the stakes because false information can propagate downstream without a human stopping to question it. 

‍

How Lasso Contains Misinformation

‍

• Discover: Determine which model outputs actually initiate real-world actions. An incorrect answer becomes a security concern at the point it becomes an action.
• Assess: Test whether the agent will act on information it never actually retrieved.
• Protect: Because the model's reasoning, its retrieved sources, and its resulting actions are all evaluated together, we can establish whether an action was grounded in retrieved evidence or fabricated, and trace a given action back to the source that produced it.

‍

No AI security system can reliably adjudicate factual truth. Instead, Lasso verifies something narrower and more useful: whether the agent's actions are traceable to material it genuinely retrieved. A tool that scores model responses in isolation cannot do this, because it never observes the actions those responses trigger.

‍

Defense Posture Across the Remaining Threats

‍

The remaining six threats are less surprising, but no less essential. 

‍

Sensitive Information Disclosure remains stable at number two because the risk is fundamental. Supply Chain, Data Poisoning, Unbounded Consumption, Hidden Context Exposure, Embedding Weaknesses, and Improper Output Handling are all material risks that remain critical in the 2026 list.

‍

Threat 2: Sensitive Information Disclosure (LLM02:2026)

‍

Sensitive Information Disclosure ranks number two, and here practitioner concern and incident evidence align. Sensitive data can surface through model outputs, retrieved context, tool calls, logs, embeddings, and other parts of the AI pipeline.

‍

Detection is difficult because disclosure does not always appear as an obvious identifier. Sensitive information may be paraphrased, encoded, or exposed through channels that simple pattern matching will miss.

‍

Protecting Sensitive Information with Lasso

‍

• Discover: Maintain an inventory of which applications and models can reach which data sources.
• Assess: Test the exfiltration paths directly, attempting to induce the customer's own AI to disclose protected data.
• Protect: Lasso runs classifiers across model output and uploaded documents to identify personal and sensitive data. A classifier is a model trained to recognize one specific category of content. They weigh the surrounding text rather than the pattern alone, so matches that are structurally valid but wrong in context, such as a hardware serial number that satisfies a credit-card pattern, are not reported as findings.

‍

Why Specialized Classifiers Rather than One General Model? 

‍

A single model exposes a single sensitivity setting. Raising it to catch more sensitive data simultaneously raises interference with legitimate traffic, because one threshold governs everything. Independent classifiers, each trained and calibrated for one category, are tuned separately, so accuracy on one risk is never traded against another.

‍

Threat 4: Supply Chain (LLM04:2026)

‍

The AI supply chain extends well beyond software packages. Models, datasets, adapters, conversion pipelines, and deployment platforms can all introduce risk. A compromised artifact can be poisoned, tampered with, or replaced before it ever reaches production.

‍

AI systems increasingly depend on third-party models and reusable components, so teams need to know whether what reaches production is the artifact they intended to deploy.

‍

Lasso Addresses Supply Chain Risk in 3 Stages

‍

• Discover: Establish which models and endpoints applications are actually calling in production, including those never formally registered.
• Assess: Baseline each model's normal behavior, so deviation has a reference point.
• Protect: Alert when a model expected to remain unchanged begins behaving differently.

‍

Most organizations cannot reliably enumerate the models running inside their own products. Runtime inventory answers that first, and behavioral baselining then makes substitution detectable without requiring inspection of the model itself.

‍

Threat 5: Data & Model Poisoning (LLM05:2026)

‍

Training data, fine-tuning datasets, and other persistent model inputs can all be poisoned. Attackers may introduce malicious or biased content that changes model behavior while leaving normal performance largely intact.

‍

Some attacks are designed to stay quiet until a particular trigger appears. That makes poisoning difficult to catch through standard evaluation alone: the model may look normal until the compromised behavior is activated.

‍

Importantly, detection does not depend on knowing the cause. Compromised training, injected instructions, and straightforward model error all present identically, as an action inconsistent with declared intent.

‍

Discover-Assess-Protect: A System for Preventing Model Poisoning

‍

• Discover: Accumulate a behavioral baseline from ordinary production traffic, automatically and continuously.
• Assess: Compare current behavior against that baseline retrospectively, including for questions that were not being asked when the traffic was served.
• Protect: Lasso flags behavioral drift in a model, and detects the harmful action itself at the point it occurs.

‍

Threat 6: Unbounded Consumption (LLM06:2026)

‍

Unbounded Consumption covers the cost and availability risks that emerge when LLM workloads consume far more resources than intended. In agentic systems, one task can fan out into recursive or repeated tool calls, driving token use and compute costs far beyond the original request.

‍

The difficulty is that individual requests may still look legitimate. In fact, the majority of runaway consumption involves no attacker at all. It is defective agent logic on a legitimate task, which makes it a reliability problem before a security one.The problem becomes visible in the pattern across the workflow.

‍

How to Mitigate Unbounded Consumption

‍

• Discover: Capture cost, token consumption, latency and model identity per call, attributable to the specific application and session responsible.
• Assess: Adversarial testing surfaces the failure mode directly: agents re-invoking the same tool against the same input repeatedly, receiving identical results, without progressing.
• Protect: Identify the structural signature in the execution sequence: identical tool, identical arguments, repeated, with no advancement toward completion.

‍

Threat 8: Hidden Context Exposure (LLM08:2026)

‍

Hidden Context Exposure covers system prompts, tool schemas, policy logic, and other non-user-facing context that can reveal how an application works. OWASP’s guidance is to assume this context can be discovered and avoid treating its secrecy as a security boundary.

‍

The risk is what an attacker can do with that knowledge. Exposed tool definitions, permissions, refusal logic, or workflow rules can make later prompt injection and reconnaissance far more targeted.

‍

Protect Hidden Context by Meaning, Not Wording

‍

• Discover: Catalog the system instructions, tool definitions and confidential context that must remain protected in each application.
• Assess: Test extraction from both directions: direct requests from the user, and requests concealed within content the agent retrieves.
• Protect: Detection compares the meaning of the model's output against the meaning of the protected instructions, rather than their wording. With Lasso, semantically equivalent output indicates disclosure regardless of the vocabulary used. 

‍

This approach defeats tactics like filtering for the instructions verbatim. Comparison by meaning works in a similar way to plagiarism detection, which catches paraphrase, rather than only catching verbatim copying.

‍

Threat 9: Vector & Embedding Weaknesses (LLM09:2026)

‍

Vector stores and embeddings create their own security layer. Weak access controls can expose data across tenants, while poisoned or manipulated content can steer retrieval toward attacker-controlled material.

‍

Compromising retrieval requires no intrusion, only the ability to place a document where the agent will find it, such as an editable page or an indexed shared drive, containing instructions rather than merely inaccurate information. Critically, that content does not originate with the user, so it bypasses whatever inspection user input receives. It arrives already trusted. Evaluating retrieved content at the point of use closes that gap.

‍

Closing the Retrieval Blind Spot

‍

• Discover: Map which retrieval sources feed which agents, so retrieved content is inspectable rather than opaque.
• Assess: Introduce adversarial documents into a test environment and determine whether the agent acts on them.
• Protect: Evaluate what the agent retrieves. Lasso identifies content that attempts to alter the agent's behavior after retrieval, and names the source document.

‍

Threat 10: Improper Output Handling (LLM10:2026)

‍

Model output often becomes another system’s input. Generated code may be executed, generated text rendered in a browser, or generated values passed into downstream tools. If that output is trusted without validation, the model can become an indirect path to XSS, remote code execution, privilege escalation, and other application-layer attacks.

‍

Treat Model Output as Untrusted Input

‍

• Discover: Classify whether an output contains code, and of what kind. Code-security policy cannot be applied until an output is known to be code, so this classification is the prerequisite step.
• Assess: Scan generated code for known-dangerous constructs, principally injection flaws that permit an outsider to reach the underlying database or execute commands on the host.
• Protect: Lasso blocks vulnerable output and runs customer-defined detection patterns in a hardened engine, reducing the risk that malicious or poorly constructed patterns create their own availability issues.

‍

From Framework to Action

‍

Lasso translates the Top 10 into operational reality: every attack, red teaming finding, and guardrail invocation is mapped against the framework, giving you continuous visibility into your AI security posture and compliance status.

‍

Book a demo to see how your organization stacks up.