OWASP GenAI
LLM Top 10 2026

Untrusted instructions can alter model behavior, including instructions embedded indirectly in retrieved or tool-provided content.

An agent reads a repository issue containing hidden instructions that attempt to redirect its next tool choice.

Prompt defenses remain primary. Runtime visibility becomes relevant if manipulated output forms a consequential action.

Sensitive information may be exposed through model output, context, logs, tools or downstream operations.

An agent includes confidential context in a request to an external service that is not approved for that data.

Data minimization, access control and output handling remain essential. Runtime policy may constrain supported transfers to disallowed destinations.

An LLM application is given more autonomy, permissions or functionality than the task requires.

A coding agent with broad local permissions attempts a destructive command while completing a routine maintenance task.

Least privilege and human approval are foundational. Pre-execution action policy adds a direct control at the point of consequence.

Models, datasets, packages, plugins and services can introduce risk through compromised or untrusted dependencies.

An agent proposes installing a package whose source or identity is not allowed by enterprise policy.

Provenance, signing, scanning and dependency governance remain primary. Runtime controls can complement them at supported install actions.

Manipulated training, fine-tuning or operational data can bias or backdoor system behavior.

Poisoned retrieved content persistently steers an agent toward an unsafe operational choice.

Dataset integrity, provenance, validation and model testing are primary. Runtime observation may reveal downstream behavior but does not repair poisoning.

Uncontrolled requests or agent loops can consume excessive compute, tokens, tools or dependent-service capacity.

A multi-step agent repeatedly calls a costly external tool without an effective budget or termination condition.

Quotas, budgets, rate limits and lifecycle controls are the direct safeguards. Runtime telemetry can help identify repeated action patterns.

Plausible but false or misleading output can influence people or automated decisions.

An agent acts on an incorrect model conclusion and prepares an operational change based on false assumptions.

Grounding, provenance, verification and human review address truthfulness. Runtime controls address consequences, not factual accuracy.

System instructions, hidden prompts or private contextual data can be revealed or inferred.

A user induces an application to reveal internal instructions or confidential context included in its orchestration layer.

Context isolation, secret minimization and output controls are primary. Runtime security matters only when exposure becomes a supported consequential action.

Weaknesses in vector and embedding systems can expose data, cross trust boundaries or manipulate retrieval.

A retrieval system returns attacker-controlled content from an improperly isolated collection, influencing an agent's plan.

Tenant isolation, ingestion validation, permissions and retrieval controls remain primary. Downstream action controls are complementary.

Model output is passed to downstream components without appropriate validation, encoding or contextual controls.

Generated text is treated as a shell command or tool parameter and is executed without a security decision at the action boundary.

Treat model output as untrusted and validate it for the destination context. Pre-execution policy adds a separate control when output becomes an action.