OWASP LLM Top 10:2026 awareness list (not web Top 10, not ASVS, not AI RMF, not an Atlas seal)

What category of awareness document this is

The OWASP Top 10 for LLM Applications (also called the OWASP GenAI LLM Top 10) is a community-developed awareness document for developers, architects, data scientists, security practitioners, and organizations building or operating applications that use large language models. It is meant to educate and to start conversations about critical LLM-application risks. It is not the web OWASP Top 10, not ASVS, and not NIST AI RMF.

Who it commonly frames: AI path readers leaving G1 through G3, AppSec readers who already met the sentence that the LLM Top 10 is separate and had no labeled home, buyers who treat OWASP AI verified as one seal, and Reference or AI RMF readers who already see GenAI LLM Top 10 2026 as a separate list. This is an industry awareness list. It is not a U.S. statute, and it is not a certification scheme.

What security people most often confuse: they fold ten LLM checkboxes, web Top 10:2025, an ASVS level, AI RMF 1.0, finished G1 through G3, and an Atlas lesson into one seal. This page keeps those objects apart. The web Top 10 explainer at /learn/explainers/owasp-top-10/ stays the web awareness list. The ASVS explainer at /learn/explainers/owasp-asvs/ stays the verification project. The Reference card at /reference/frameworks/owasp-top-10-2025/ stays the web framework summary. The AI RMF explainer at /learn/explainers/nist-ai-rmf/ is the labeled literacy home. The field guide at /reference/frameworks/nist-ai-rmf-1-0/ stays the edition pin. This explainer complements them. It does not replace any of them, and it does not reprint category bodies.

LLM01 through LLM10 are category labels

The ten names in the table on this page are the official OWASP Top 10 for LLM Applications 2026 category labels. They are awareness category labels, not a finished test plan, and not permission to paste official attack scenarios into Atlas. This page stops at the name. It does not reprint the risk text, the mitigations, or the weakness lists on the official pages.

The AI path already teaches two of these names without this page becoming a fourth lesson. G1, prompt injection and retrieval trust at /learn/topics/prompt-injection-and-retrieval/, practices the LLM01 theme. G2, excessive agency at /learn/topics/excessive-agency/, practices the LLM03 theme. G3, human oversight at /learn/topics/human-oversight-gates/, practices a human gate. Open those lessons for the practice. This page does not rewrite them. Finishing G1 through G3 does not seal this list.

A hallway poster that checks all ten boxes is still a poster. The label tells people which conversation they are in. It does not close a test, and it does not require anyone to memorize ten category essays. A separate OWASP Top 10 for Agentic Applications exists for cases where a model acts as an actor. This page names that list only. It does not open an Atlas card for it.

Name the theme, then keep the evidence

Pick one real or synthetic LLM-powered feature. LanePay on the AI path, and ScheduleClerk in the agent lab, are the synthetic examples already on this site. Use an LLM Top 10 theme as a shared name for the conversation, then move to verifiable evidence: tool authorization, a human gate, retrieval trust, or a blast-radius limit.

Practice stays on the existing pages. G1 is /learn/topics/prompt-injection-and-retrieval/. G2 is /learn/topics/excessive-agency/. G3 is /learn/topics/human-oversight-gates/. The lab is /labs/agent-tool-auth/. The path is /learn/paths/ai-agent-security/. The landscape segment, when you are comparing control purposes, is /landscape/segments/ai-agent-security/. This page does not replace those.

When the risk is a classic web application risk, use the web Top 10 explainer at /learn/explainers/owasp-top-10/. When the need is leveled verification requirements, use ASVS at /learn/explainers/owasp-asvs/. When the need is Govern, Map, Measure, and Manage placement, use the AI RMF explainer at /learn/explainers/nist-ai-rmf/. The field guide stays at /reference/frameworks/nist-ai-rmf-1-0/. Do not collapse those lanes. The six-map comparison is /reference/frameworks/compare/. It does not add a seventh map object for this list.

What this card is not

Not an LLM course. Not a G4 revival. Not a mitigations encyclopedia. Not a CWE dump. Not exploit or red-team PoC homework. Not a web Top 10 rewrite. Not an ASVS rewrite. Not a replacement for the AI RMF explainer at /learn/explainers/nist-ai-rmf/. Not a replacement for the web Top 10 explainer at /learn/explainers/owasp-top-10/, the ASVS explainer at /learn/explainers/owasp-asvs/, the Reference card at /reference/frameworks/owasp-top-10-2025/, or G1 through G3. Not a rewrite of those lessons. Not permission to invent an adoption statistic. Not a claim that G1 through G3 done means this list is sealed. Not an Atlas attestation of LLM Top 10 completion.

Not a CSF 2.0 profile. Outcomes live on /learn/topics/outcomes-then-controls/ and on /reference/frameworks/nist-csf-2-0/. The OWASP row on the six-map comparison says the purpose is awareness of common application risks, that the web list is not ASVS and not the LLM Top 10, that certifiable is No, and that a typical misuse is treating the list as a complete test standard. A row is not this page. This page is the labeled home for the separate LLM list that row names.

Rewrite the one-line claim

Replace "we are Top 10, ASVS, LLM Top 10, AI RMF, OWASP AI, and Atlas AI compliant" with a reading sentence. We use OWASP GenAI LLM Top 10 2026 as a limited LLM-application awareness list (LLM01 through LLM10 labels). That is different from web Top 10:2025, from ASVS 5.0.0 verification depth, from NIST AI RMF 1.0 (/learn/explainers/nist-ai-rmf/), from finished G1 through G3 practice, and from an Atlas seal.

When a slide says "OWASP AI verified" or "LLM Top 10 compliant," privately ask which edition, which theme was actually tested, and which application evidence supports it, and whether the live need is LLM awareness, web Top 10 awareness, ASVS verification depth, or AI RMF placement. Do not paste proprietary prompts, customer data, or exploit kits into Atlas.

Ten LLM boxes are not secure, not web Top 10, not ASVS, not AI RMF, and not an Atlas seal

Teaching table only. It does not assign a certificate, a finished test, an ASVS level, an AI RMF result, or an Atlas seal.

LLM01:2026 through LLM10:2026, as labels

Official 2026 category names, slogan depth only. This table does not reprint OWASP risk text, mitigations, or CWE identifiers.

Glossary and nearby pages

• Prompt injection
• Excessive agency
• Blast radius
• Trust boundary
• Evidence

• OWASP Top 10 explainer (web awareness list, not replaced by this page)
• OWASP ASVS explainer (verification requirements, not replaced by this page)
• OWASP Top 10 Reference card (web framework summary, not replaced by this page)
• NIST AI RMF 1.0 explainer (voluntary framework, not this list)
• NIST AI RMF 1.0 field guide (edition pin companion, not this list)
• Compare the six maps (a row is not this list, and not a seventh map)
• Prompt injection and retrieval trust (G1)
• Excessive agency (G2)
• Human oversight as a designed process (G3)
• Lab: Two tools, one blast radius
• AI application and agent security path
• Landscape: AI application and agent security
• OWASP Top 10 for Agentic Applications 2026 (name only, no Atlas card)
• Outcomes first, then controls (F8a)
• Privacy is not a CIA checkbox