The OWASP AI Top 10 just got a genuine shake-up, not a reshuffle. OWASP built the 2026 edition partly on real incident data for the first time, not practitioner opinion alone, and the rankings moved to match. Excessive Agency jumped from sixth to third. Improper Output Handling fell from fifth to tenth. This means that the scope for your AI & LLM security testing should shift too.
Most OWASP Top 10 updates move a category or two a year. The 2026 OWASP AI Top 10 didn't. For the first time, OWASP tested practitioner belief against a body of real incidents. The evidence got to move rankings that the vote alone wouldn’t have touched.
That distinction matters if you're the one deciding what an AI security test covers. A list built purely on opinion tells you what worries people. A list checked against incidents tells you where the damage has been landing.
You'll see this one referred to as the OWASP AI Top 10 in some places and the OWASP Top 10 for LLMs in others. Same document, different shorthand. The OWASP lists are part of our AI and LLM security testing framework, so we naturally monitor the changes closely. Here’s what changed and what it means.
Why the Rankings Moved This Year
Every OWASP Top 10 before this one rested on a single input: practitioner opinion. Hundreds of security professionals voted on what worried them most, and that vote decided the order.
The 2026 AI edition keeps the vote, but it's no longer the only input.
OWASP pulled together a corpus of 7,714 real incidents, drawn from public vulnerability databases and an AI-harm database. They classified 6,639 of them with enough detail to sort by category. Then they weighted that evidence against the vote. The community's opinion still carried 75% of the decision, while the incident record carried the remaining 25%.
That quarter-weight is deliberate. OWASP's project leads explained this, saying that a single noisy year of incident data shouldn't overturn the judgement of the people doing the work. But a quarter is still enough to move an entry a full tier when the gap between belief and evidence runs wide. In a few places this year, it ran very wide.
Misinformation: The Clearest Case for the New Method
Misinformation is the entry that shows what this new method catches best. Practitioners ranked it near the bottom of the list. Left to the incident record alone, it would sit near the top. That's the widest gap OWASP found in either direction, between what people feared and what the evidence showed.
The final list splits the difference. Misinformation landed in the middle, not because OWASP hedged but because that's what a 75/25 weighting produces when the two inputs disagree so sharply. The vote holds the majority. The evidence pulled the entry up several places from where the vote alone would’ve put it.
Why was there a gap in the first place? A wrong answer from a model doesn't look dramatic on its own. It looks dramatic once someone acts on it.
- A coding assistant recommends a package that doesn't exist. An attacker has already registered it under that name.
- A support agent misreads a policy and approves a refund it shouldn't.
- Your security tool misclassifies normal traffic and blocks a production system.
Practitioners tend to worry about the flashier failure modes. The incident record doesn't care which failure mode is flashier. It only tracks which one happened.
Where the OWASP AI Top 10 List Moved Most
A handful of entries drove almost all of this year's movement. The rest held steady or shifted by a single place.
Excessive Agency: 6th to 3rd
One of the biggest risers. Both inputs agreed on this one; practitioners are worried about agentic deployments, and the incident record backed them up. When a model can call tools, hold memory, and take actions with real consequences, that's where the damage in the record was landing.
Improper Output Handling: 5th to 10th
The biggest faller in 2026. It's not that the risk lessened. Everything else got weighted up faster. Agentic and tool-connected systems produced more incidents, and more consequential ones, than an app overtrusting model output.
Unbounded Consumption: 10th to 6th
Agentic setups are part of the reason it rose four places. A single request can now fan out into dozens of tool calls, and every one of them adds to the bill.
System Prompt Leakage to Hidden Context Exposure: 7th to 8th
Renamed and broadened, not just moved. It's not just the system prompt anymore. It's any hidden material a model assembles into its context, including tool schemas, retrieved policy text, developer instructions, all of it.
Sensitive Information Disclosure: Held 2nd
This is the one spot on the list where the vote and the evidence simply agree. It's also why OWASP's confidence in this ranking is highest.
Prompt Injection: Held 1st
The story here is less straightforward. Rank the categories by raw incident count alone, and Prompt Injection falls out of the top ten. That's not because the risk got smaller. It's what OWASP calls a defence effect.
Mature teams fight injection hard enough that fewer clean exploits ever reach a public database. That undercounts a risk that still sits wherever a model reads untrusted input. The vote kept Prompt Injection at number one for that reason.
Absorption, Not New Categories
OWASP didn't add new entries to fit newer risks in. It folded them into the categories that already owned the ground, rather than splintering the list further.
Prompt Injection now explicitly covers cross-modal attacks, including instructions hidden inside an image or an audio track, not just text. If your app accepts anything other than typed input, that's squarely in scope now. It's not a grey area you had to argue your way into before.
Supply Chain now covers model authenticity specifically, whether a promoted or "verified" model artefact is what it claims to be.
Data and Model Poisoning absorbs fine-tuning subversion rather than treating it as its own concern. A poisoned fine-tuning dataset and a poisoned pre-training dataset now sit under the same heading.
Improper Output Handling now spans insecure code that an AI coding assistant generates and a developer ships without review. That's a newer angle, one that wasn't really read as an "output handling" problem two years ago.
The incidents behind each of these were always real. They just didn't have a clearly named home in the list before this year.
Where OWASP Top 10 for LLMs Ends and the Agentic Top 10 Begins
The OWASP AI Top 10 owns the risk when a model is a component inside your application, something that receives input and produces output. Once it has tools it can call and memory it carries between sessions, the risk moves.
Anything with consequences it sets in motion downstream belongs to OWASP's Top 10 for Agentic Applications instead. Plenty of incidents sit right on that line.
A chatbot that occasionally gives a wrong answer is in the AI Top 10's territory. However, the same chatbot with the ability to issue refunds, send emails, or query a database on its own has stepped into agentic territory too. It needs both lists covering it, not just one.
What This Means for Your Testing Programme
If agentic deployments are anywhere on your plans, Excessive Agency should also move up your priority list. That's true whether you're scoping your first AI security test or reviewing an existing programme.
If your testing has been scoped tightly around output handling, because that's where the old list pointed you, this year's data has a simple message. It's less urgent than it was, not irrelevant.
He changes to Prompt Leakage, now named Hidden Context Exposure, is an important shift for your team, despite it only moving one place. If your last review was scoped narrowly around whether the system prompt leaks, widen it. Tool schemas and retrieved policy text are both now explicitly in scope.
A rebalanced list is a reason to revisit scope, not a reason to drop a category altogether.
The List Sets Our Direction, Not the Whole Scope
The OWASP Top 10 AI, LLM, and Agentic lists give all our artificial intelligence-related engagements a shared structure. It's a way to map findings back to something a client's auditor or procurement team already recognises. But the list only tells you the most important categories of risk that exist. It doesn't tell you which ones your specific system is exposed to or how an attacker would try them.
That's where engagement experience carries the rest of the weight. We bring in what we've seen break in real assessments, as well as patterns from frameworks like MITRE ATLAS. We also bring judgement calls the list can't make on its own.
Testing against ten categories isn't ten separate checks run in isolation. It's ten starting points for chaining findings the way an attacker would.
Your Last Scope Was Built on the Old Rankings
If your AI security testing was scoped against the 2025 list or without a verified framework in mind, take a look at this year's rebalancing. Based on your systems and budget, we help you work out which categories deserve more weight now and which ones you can afford to ease off.
Talk to Us About Your AI Testing Scope
OWASP AI & LLM Top 10 Questions We Often Answer
Who Decides What Goes on the List?
Project leads and entry leads manage the process for each category, supported by the wider OWASP GenAI Security Project community. Hundreds of practitioners vote each cycle. This year, for the first time, that vote sat alongside real incident data, rather than deciding the order alone.
Is the OWASP AI Top 10 the Same as the OWASP Top 10 for Web Applications?
No. They're separate lists covering almost entirely different risk categories. An LLM-powered product built on top of a conventional web app or API should be pentested against both.
How Often Does OWASP Update Their Lists?
Roughly annually, now that it's settled into a rhythm. Version 1.0 shipped in August 2023, and version 1.1 followed two months later in October 2023. The next major edition landed in November 2024, and the 2026 edition was published this month, on 3 August 2026.
Should I Redo Testing I Already Scoped Against in 2025?
Not from scratch. The categories didn't disappear. They moved and, in places, broadened. If your last engagement covered System Prompt Leakage, that work still applies to what's now the more broadly scoped Hidden Context Exposure. If you are concerned, you’re welcome to reach out to us.
Scope Testing Around Where the Risk Sits
Rankings shift. What doesn't change is the value of testing scoped to your system, not a generic checklist. Whether that means weighting more toward agentic risk or keeping a broader spread, a scoping call is where that gets decided.
Get Your Priorities Sorted
Want to Read More?
- Ensure your organisation is prepared for upcoming regulatory requirements by reading our guide on what businesses should know about the EU AI Act.
- Explore the specific risks, validation approaches, and practical examples of framework testing and see how we apply the OWASP LLM Top 10 in our AI pentesting.
- Clarify your security needs and understand the differing methodologies with our AI red teaming and AI pentesting comparison.
