OWASP LLM Top 10 2026: Fix Your Crosswalk, 8 IDs Moved

OWASP published the Top 10 for LLM Applications 2026 (v1.0) on 3 August 2026, and eight of the ten identifiers now point at a different risk than they did in 2025. Only LLM01 and LLM02 survived unchanged. Every crosswalk, policy clause, and customer questionnaire answer that cites a bare LLM0x is now ambiguous, and the risk that moved furthest, Excessive Agency from #6 to #3, is the one your auditor will push hardest on. These tips are for the person who has to answer the questionnaire, defend the control set at renewal, or sign the ISO 42001 statement of applicability for a system that holds credentials and calls tools, the surface I wrote about in MCP OAuth 2.1.

Bare ID	Meant in 2025	Means in 2026
LLM01	Prompt Injection	Prompt Injection
LLM02	Sensitive Information Disclosure	Sensitive Information Disclosure
LLM03	Supply Chain	Excessive Agency
LLM04	Data and Model Poisoning	Supply Chain
LLM05	Improper Output Handling	Data and Model Poisoning
LLM06	Excessive Agency	Unbounded Consumption
LLM07	System Prompt Leakage	Misinformation
LLM08	Vector and Embedding Weaknesses	Hidden Context Exposure
LLM09	Misinformation	Vector and Embedding Weaknesses
LLM10	Unbounded Consumption	Improper Output Handling

One warning before the list: any assistant trained before August will answer you in 2025 numbering with complete confidence, so verify every ID against the resource page above rather than against a chat window.

The tips

1. Grep your policy estate for bare IDs and count them before you promise a timeline. The remap cost is a number you can produce in a minute, and producing it first turns "we should update that" into scoped work. Run this across policies, contracts, SOA spreadsheets exported to text, and your questionnaire answer library:
   

   rg -Pc 'LLM(0[1-9]|10)\b(?!:20)' --glob '!node_modules' . | sort -t: -k2 -nr
   

   The (?!:20) lookahead skips anything already year-qualified as LLM06:2025, so what remains is exactly the set of citations that changed meaning under you. -P is required for the lookahead; without it ripgrep refuses the pattern. Fix each hit by adding the year, never by bumping the number, because the old clause described the old risk and your evidence was collected against it.

2. Decide which OWASP list you are being assessed against, and say so in writing. OWASP now maintains the LLM Applications Top 10 2026 (LLM01 to LLM10) and a separate Top 10 for Agentic Applications 2026 (ASI01 to ASI10), the latter released 9 December 2025 per OWASP's own resource page. The agentic list covers goal hijack, tool misuse, privilege abuse, memory poisoning, cascading failures, and rogue agents, all of which only exist once the model holds credentials. If you ship agents and answer only against the LLM list, you have answered the easier question and the assessor will find that out later.
   

   flowchart TD
     A["What are you being asked to prove?"] --> B{"Does the system call tools or act?"}
     B -->|"No: prompt in, text out"| C["LLM Top 10 2026 v1.0\nLLM01-LLM10, 3 Aug 2026"]
     B -->|"Yes: goals, memory, credentials"| D["Agentic Top 10 2026\nASI01-ASI10, 9 Dec 2025"]
     D --> E{"Can you show runtime evidence?"}
     E -->|"No"| F["Agent Control Standard v0.1\nAgBOM plus OTel/OCSF traces"]
     E -->|"Yes"| G["Map each ASI to one queryable artifact"]
     C --> G

3. Know why Excessive Agency moved, because it changes what counts as evidence. The 2026 ranking weighted expert vote at 75% and real incident data at 25%, drawn from 6,639 classifiable records out of 7,714 pulled from public vulnerability and AI-harm databases, as Help Net Security and ReversingLabs both reported from the launch. Excessive Agency climbed on incident counts, so reassurance about your design intent reads poorly against it. Bring numbers from the runtime layer you already operate: tool calls per session, blocked write attempts, approvals requested and denied. If you have no such layer yet, Falco, Tetragon, and Tracee are where the syscall-level half of that evidence comes from.

4. Retire prompt-filter percentages as your answer to LLM03:2026. OWASP's framing at launch was that you build the system around the model so that when it is fooled, and it will be, nothing important breaks. A filter accuracy figure answers a containment question with a prevention number, and reviewers who read the 2026 text notice. Show four limits instead: a per-session tool-call ceiling, a per-agent spend cap, a wall-clock timeout, and a circuit breaker that trips on consecutive tool failures.
   

   if session.tool_calls >= LIMITS["max_tool_calls"] \
      or session.spend_usd >= LIMITS["max_spend_usd"] \
      or session.consecutive_tool_errors >= 3:
       raise AgentHalted(session.id)   # emit an OCSF event, page nobody, fail closed
   

   The network half of the same control is a default-deny egress policy on the namespace the agent runs in, which caps the damage of a tool call you did not anticipate.

5. Treat LLM08 Hidden Context Exposure as a scope expansion for DLP and re-run classification. System Prompt Leakage was retired and replaced by Hidden Context Exposure, which covers everything assembled into the window: retrieved documents, agent memory, tool schemas, tool responses, and application state. The item most teams forget is the tool schema. Parameter descriptions routinely carry internal endpoint names, table names, and business rules, and all of it leaves on a single "list your tools" turn. Dump your registered schemas and read them as an attacker would before you claim coverage.

6. Instrument the context assembler so the LLM08 answer is a query. A reviewer asking what your model can leak deserves a search result rather than a paragraph. Emit one span event per injected source carrying a classification label, then answer by querying for any trace where a source labelled internal appears in a session whose response crossed the tenant boundary. Without that event you can only assert, and an assertion is what gets you a finding at the next audit.

7. Do not accept output sanitisation as a vendor's headline control. Improper Output Handling fell from #5 to #10. It stayed on the list for good reason, since model output still reaches shells, SQL, and browsers, but a pitch that leads with output filtering is selling you coverage of the tenth-ranked risk while the third-ranked one sits unowned. Ask where the agency limits live, who can raise them, and what the audit trail looks like when someone does, before you ask about filters.

8. Answer ASI03 with per-agent identity and be ready for the delegation follow-up. Identity and Privilege Abuse is where most agent programmes fail an assessment, because one shared service account backs every agent in the fleet. The defensible shape is a distinct workload identity per agent plus a short-lived, user-scoped token per action, which is the same migration described in bound ServiceAccount tokens. Expect the assessor to ask what happens when agent A calls agent B, so have the token exchange path drawn before the call.

9. Use the Agent Control Standard for inventory today and price its roadmap honestly. ACS was donated to the OWASP GenAI Security Project and announced on 1 September 2026, alongside the news that the community passed 30,000 members. Read the repository before you plan around it: the public preview is v0.1, Apache-2.0 for code and CC BY-SA 4.0 for docs, and it ships definitions plus observability schemas today, meaning OpenTelemetry and OCSF tracing and an Agent Bill of Materials expressed in CycloneDX, SWID, or SPDX. The published milestones put guardian-agent instrumentation at v1, AgBOM mappers at v2, and deny and modify operations at v3. Anyone selling ACS-based blocking this quarter is ahead of the specification. Adopt the AgBOM now as your inventory artifact, generated by the same tooling that already produces your Syft SBOMs, and keep enforcement where it currently works.

10. Give every risk one artifact and one query, then date-stamp the crosswalk. Auditors accept "control, artifact, query" and argue with prose. Build the table as risk ID with year, control, artifact, and the exact command or saved search that produces it. Set two review dates rather than one, because the two lists run on different clocks: the agentic list shipped December 2025 and the LLM list August 2026, so a single annual review will always miss one of them.

FAQ

Does LLM06 still mean Excessive Agency? No. In the 2026 list LLM06 is Unbounded Consumption. Excessive Agency is LLM03:2026. Cite the year and the name together so the sentence survives the next revision.

Which list applies if my app only summarises documents? The LLM Applications Top 10 2026. The agentic list applies once the system pursues goals, keeps memory across turns, or holds credentials to act.

Can I use the Agent Control Standard to block agent actions now? Not from the standard itself. v0.1 ships definitions and observability schemas, with deny and modify operations scheduled for v3 in the published milestones.

Wrap-up

Write the year every time you cite an OWASP identifier. LLM06 was Excessive Agency for a year and is now Unbounded Consumption, and a contract clause that says only LLM06 will eventually be read by someone who was not in the room when it was written. Run the grep from tip 1 this week and publish the remap table internally, so you know the size of the job before a customer asks you to have already finished it.

---

Originally published at indragustiprasetya.com