Overview
Use the OWASP Top 10 for LLM Applications as the risk taxonomy for anything that puts a model in the request path: chatbots, RAG pipelines, and tool-calling agents. It is separate from the web Top 10 because a model that follows instructions embedded in its input is doing what it was built to do, only for the attacker. The current edition is 2026, published August 2026 by the OWASP GenAI Security Project (source repository); it replaces the 2025 edition. Excessive Agency rose from #6 to #3, Unbounded Consumption from #10 to #6, and System Prompt Leakage became the broader Hidden Context Exposure. Agent-specific risks are covered by a companion list, the OWASP Top 10 for Agentic Applications (December 2025, ASI01 to ASI10, starting with Agent Goal Hijack and Tool Misuse and Exploitation).
LLM01 Prompt Injection: treat all model input as untrusted
An attacker embeds instructions in data the model reads (a document, a webpage, a tool result) that override or redirect the system prompt. Separate untrusted data from instructions at the prompt level (prompt-injection-defense), then bound the damage with least-privilege tools, confirmation gates, and sandboxing (prompt-injection-defense). Injected instructions can persist in memory or a RAG corpus, so one success can affect later sessions. Term: prompt-injection.
LLM02 Sensitive Information Disclosure: redact before the model sees it and before output leaves
A model can leak training data, retrieved documents, or conversation history, and a tool response can carry credentials into the context window. Redact secrets and PII from tool outputs before they reach the model (mcp-security).
LLM03 Excessive Agency: grant only the permissions the task needs
Do not give a tool-calling agent broad filesystem, network, or account access “in case it needs it”. Scope tools narrowly, require human confirmation for irreversible actions (delete, pay, send), and apply per-session rate limits. See mcp-security for the allowlist and rate-limit patterns.
LLM04 Supply Chain: vet models and MCP servers like dependencies
A poisoned base model, a compromised registry, or a malicious MCP server is a supply chain risk. Verify provenance before adding one, and pin model versions rather than tracking a floating alias. The general control is in A03 of the web list.
LLM05 Data and Model Poisoning: the training or retrieval corpus is the attack surface
Whoever can write to a RAG index or fine-tuning dataset can steer behavior without sending a malicious prompt. Restrict write access to any corpus the model retrieves from or trains on, and validate documents before indexing (rag-vector-databases).
LLM06 Unbounded Consumption: cap tokens, tool calls, and spend
Without limits on prompt size, output length, and tool-call volume, one request or a runaway agent loop exhausts quota and runs up cost. Cap max tokens, set per-session tool-call limits, and add a circuit breaker that disables a tool after repeated failures (mcp-security).
LLM07 Misinformation: a confident wrong answer is a security failure
A fabricated citation, API parameter, or fact can cause real harm when output drives a decision or an action. Ground high-stakes answers in retrieval with citations, and mark unverified generated content (rag-citations).
LLM08 Hidden Context Exposure: assume everything in the context can be extracted
This broadens System Prompt Leakage to all context the user does not see: system instructions, tool descriptions and schemas, RAG schemas, and policy text. Anything there should survive being read aloud, with no API keys or secret rules. Treat prompts as a behavior spec the user may see, and put access decisions in code (system-prompts).
LLM09 Vector and Embedding Weaknesses: the retrieval index needs the same access control as the database
Anyone who can insert into a vector store can poison retrieval, and an index without per-tenant filtering leaks one customer’s documents into another’s context. Apply row-level or namespace-level access control (rag-vector-databases, supabase-rls).
LLM10 Improper Output Handling: model output is attacker-controlled once injection succeeds
Never pass model output to eval(), a shell, SQL, or innerHTML without the validation you would give any untrusted input. Validate at the sink (prompt-injection-defense).