SynapsedOWASP Top 10 for LLM Applications 2026
2026 editionExplore the ten categories through implementation examples, design decisions and testing questions. This Synapsed learning guide follows the 2026 OWASP ordering and connects awareness with evidence for the AI systems your team builds.
Official category definitions: OWASP GenAI Security Project. Examples and teaching guidance: Synapsed adaptation. View the official release →
What changes in the 2026 edition?
Excessive Agency moves to LLM03, Unbounded Consumption to LLM06 and Improper Output Handling to LLM10. Hidden Context Exposure replaces the narrower System Prompt Leakage entry. The explorer and exercises below use the new identifiers throughout.
Compare the 2025 and 2026 identifiers
| 2026 identifier | 2026 category | Previous identifier |
|---|---|---|
| LLM01:2026 | Prompt Injection | LLM01:2025 |
| LLM02:2026 | Sensitive Information Disclosure | LLM02:2025 |
| LLM03:2026 | Excessive Agency | LLM06:2025 |
| LLM04:2026 | Supply Chain | LLM03:2025 |
| LLM05:2026 | Data and Model Poisoning | LLM04:2025 |
| LLM06:2026 | Unbounded Consumption | LLM10:2025 |
| LLM07:2026 | Misinformation | LLM09:2025 |
| LLM08:2026 | Hidden Context Exposure | LLM07:2025 · System Prompt Leakage |
| LLM09:2026 | Vector and Embedding Weaknesses | LLM08:2025 |
| LLM10:2026 | Improper Output Handling | LLM05:2025 |
Connect the categories to your testing programme.
This is Synapsed’s suggested testing lens across AI Application, Model, Infrastructure and Data. It is an educational alignment to the OWASP AI Testing Guide approach; it is not an official OWASP crosswalk or a claim of complete test coverage.
| Category | Risk | Relevant layers | Testing focus |
|---|---|---|---|
| LLM01:2026 | Prompt Injection | Application | Direct and indirect prompt injection, hidden instructions, trust-boundary validation, tool-routing abuse |
| LLM02:2026 | Sensitive Information Disclosure | Application / Data | Cross-user leakage, secrets exposure, access scoping, output filtering, redaction |
| LLM03:2026 | Excessive Agency | Application / Infrastructure | Tool scoping, authorization mediation, user-context execution, human approval, action limits |
| LLM04:2026 | Supply Chain | Infrastructure / Model | Artifact provenance, package hygiene, model integrity, adapter trust, deployment review |
| LLM05:2026 | Data and Model Poisoning | Data / Model | Dataset provenance, anomaly detection, backdoor testing, retraining change control |
| LLM06:2026 | Unbounded Consumption | Infrastructure / Application | Cumulative token and cost budgets; step limits; concurrency; timeouts; stopping downstream work |
| LLM07:2026 | Misinformation | Application / Model | Unsupported claims, evidence requirements, human review, domain-specific validation |
| LLM08:2026 | Hidden Context Exposure | Application | Hidden-context extraction and inference; secret placement; independent policy and authorization enforcement |
| LLM09:2026 | Vector and Embedding Weaknesses | Data / Application | Access control before similarity search; metadata exposure; retrieval manipulation; embedding-dependent failures |
| LLM10:2026 | Improper Output Handling | Application | Unsafe outputs, HTML and Markdown execution, SQL and shell generation, schema validation |
For systems that act through tools or coordinate agents, also use the OWASP Top 10 for Agentic Applications 2026 →
Apply the learning to your AI initiative.
Connect design review with repeatable tests and evidence your team can interpret. Our work brings together training, practical assessment and the engineering of trustworthy AI.