What category of awareness document this is
The OWASP Top 10 for LLM Applications is also called the OWASP GenAI LLM Top 10. The list is a community-developed awareness document for applications that use large language models. The audience is developers, architects, data scientists, security practitioners, and organizations that build or operate those applications. The list is meant to educate and to start conversations about critical LLM-application risks. The list is not the web OWASP Top 10, not ASVS, and not NIST AI RMF.
The LLM Top 10 is an industry awareness list. The LLM Top 10 is not a U.S. statute, and the list is not a certificate scheme.
Edition covered
The edition string is OWASP Top 10 for LLM Applications 2026. The same edition is also called OWASP GenAI LLM Top 10 2026, Version 2026. The first official hub is https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/. The second official hub is https://github.com/GenAI-Security-Project/GenAI-LLM-Top10. The canonical Markdown on GitHub is under 2026/final/. On 2026-09-26, the GitHub README and 2026/README.md both stated published August 4, 2026. The Zenodo version DOI 10.5281/zenodo.22109015 also states published August 4, 2026 (Version 2026). The genai.owasp.org resource page carries the stamp August 3, 2026. GitHub gives 2026-08-04 as the canonical release day. The two hubs do not show one identical calendar day, so a single release day is UNKNOWN. Either date can shift, or a newer edition can appear. In that case, this pin must change, and the older claim is then UNKNOWN.
The concept DOI 10.5281/zenodo.22109014 resolves to the newest edition. The version DOI above is specifically the 2026 edition. The 2026 list reorders and renames some themes relative to the 2025 list. Excessive Agency is LLM03:2026. Hidden Context Exposure is a 2026 category title. Improper Output Handling is LLM10:2026.
LLM01 through LLM10 are category terms
The ten category titles in the literacy table are the official OWASP Top 10 for LLM Applications 2026 category terms. Those titles are awareness category terms, not a finished test plan. The official pages hold the risk text, the mitigations, and the weakness lists.
Prompt injection and retrieval trust (Prompt injection and untrusted retrieval (RAG): when data hijacks instructions) is the LLM01 theme. Excessive agency (Excessive agency: why a model sentence is never an authorization decision) is the LLM03 theme. Human oversight gates (Human oversight gates and the NIST AI Risk Management Framework) are a control, not one of the ten categories. Practice on two themes and one control does not cover the full list.
A separate OWASP Top 10 for Agentic Applications exists for cases where a model acts as an actor.
The theme first, then the evidence
The habit starts with one real or synthetic LLM-powered feature. One LLM Top 10 theme gives a shared term for the conversation. The conversation then moves to verifiable evidence. That evidence is tool authorization, a human gate, retrieval trust, or a blast-radius limit.
Rewrite the one-line claim
The claim "we are Top 10, ASVS, LLM Top 10, AI RMF, and OWASP AI compliant" mixes five objects. Exact replacement: "We use OWASP GenAI LLM Top 10 2026 as a limited LLM-application awareness list (LLM01 through LLM10 categories)." That use is different from web Top 10:2025 and from ASVS 5.0.0 verification depth. That use is different from NIST AI RMF 1.0 (NIST AI RMF 1.0: organizing AI risk work). It is also different from practice on a few of the ten themes.
A slide can state "OWASP AI verified" or "LLM Top 10 compliant." The team then privately asks which edition and which theme was actually tested. The team also asks which application evidence supports the claim. The team also asks whether the live need is LLM awareness, web Top 10 awareness, ASVS verification depth, or AI RMF placement.
Ten LLM boxes are not secure, not web Top 10, not ASVS, and not AI RMF
| Phrase people use | Literacy correction |
|---|---|
| We checked the ten LLM boxes, so the product is secure / certified | OWASP GenAI LLM Top 10 2026 is a limited awareness list. A check of ten themes is not a finished test and not a certificate scheme. |
| LLM Top 10 done means web Top 10:2025 done | OWASP Top 10:2025 is a separate web-application awareness list. Explainer: /learn/explainers/owasp-top-10/. Reference card: /reference/frameworks/owasp-top-10-2025/. The two lists stay separate. |
| LLM Top 10 done means ASVS done / Level N verified | ASVS is a separate requirements and verification project with leveled depth. Level N is not this list. Explainer: /learn/explainers/owasp-asvs/. Awareness terms are not ASVS evidence. |
| LLM Top 10 done means NIST AI RMF 1.0 done | NIST AI RMF 1.0 is a voluntary risk framework (Govern, Map, Measure, Manage). Explainer: /learn/explainers/nist-ai-rmf/. Field guide: /reference/frameworks/nist-ai-rmf-1-0/. |
| We control prompt injection and excessive agency, so LLM Top 10 is sealed | Prompt injection is LLM01, and excessive agency is LLM03. Lessons: /learn/topics/prompt-injection-and-retrieval/, /learn/topics/excessive-agency/, /learn/topics/human-oversight-gates/. Lab: /labs/agent-tool-auth/. Path: /learn/paths/ai-agent-security/. |
| We are OWASP AI verified / LLM Top 10 compliant | The LLM Top 10 is not a mail-order seal. A seal is not evidence that a theme was tested on the application. Six-map comparison: /reference/frameworks/compare/. |
| Our LLM feature passed a prompt injection test, so the list is covered | Prompt injection is one of ten categories. Each other theme needs its own evidence, such as tool authorization, retrieval trust, or a blast-radius limit. |
| Ten LLM checkboxes mean attackers will skip us | Awareness themes start a conversation. Awareness themes do not prove product immunity. Awareness themes do not mean that attackers will skip an application. |
Common misconceptions
Ten LLM checkboxes mean a secure product, or an OWASP AI certificate.
The list is an awareness document. Ten checked themes are a conversation, not a test result or a certificate.
Web Top 10, ASVS, the LLM Top 10, and AI RMF are the same thing.
The four are different objects. Top 10:2025 covers web risk themes. ASVS is leveled verification depth. NIST AI RMF 1.0 places work in Govern, Map, Measure, and Manage. The LLM list is its own awareness list for LLM applications.
Controls for prompt injection and excessive agency mean the LLM Top 10 is sealed.
Those are two of the ten categories. The other eight categories still apply.
The 2026 list keeps the 2025 numbering.
The 2026 list reorders and renames some themes. Excessive Agency is LLM03:2026, and Improper Output Handling is LLM10:2026.
A vendor homepage shield attests LLM Top 10 completion.
A homepage shield is not evidence that a theme was tested on the application.
The OWASP Top 10 for Agentic Applications and the LLM Top 10 are one list.
The agentic list is a separate OWASP Top 10 for cases where a model acts as an actor. The LLM Top 10 covers applications that use large language models.
LLM01:2026 through LLM10:2026, as terms
The table uses the official 2026 category titles.
| ID | Official name (2026) | Boundary |
|---|---|---|
| LLM01:2026 | Prompt Injection | Awareness category term. Not a finished test. |
| LLM02:2026 | Sensitive Information Disclosure | Awareness category term. Not a finished test. |
| LLM03:2026 | Excessive Agency | Awareness category term. Not a finished test. |
| LLM04:2026 | Supply Chain | Awareness category term. Not a finished test. |
| LLM05:2026 | Data and Model Poisoning | Awareness category term. Not a finished test. |
| LLM06:2026 | Unbounded Consumption | Awareness category term. Not a finished test. |
| LLM07:2026 | Misinformation | Awareness category term. Not a finished test. |
| LLM08:2026 | Hidden Context Exposure | Awareness category term. Not a finished test. A 2026 category title on this list. |
| LLM09:2026 | Vector and Embedding Weaknesses | Awareness category term. Not a finished test. |
| LLM10:2026 | Improper Output Handling | Awareness category term. Not a finished test. A 2026 category title on this list. |
CHECK THE CATEGORY
Which sentence matches LLM Top 10 literacy?
Glossary and nearby pages
- OWASP Top 10 explainer (web awareness list)
- OWASP ASVS explainer (verification requirements)
- OWASP Top 10 Reference card (web framework summary)
- NIST AI RMF 1.0 explainer (voluntary framework, not this list)
- NIST SSDF Version 1.1 explainer (software practice vocabulary, not this list)
- NIST AI RMF 1.0 field guide (edition pin companion, not this list)
- Compare the six maps (a row is not this list, and not a seventh map)
- Prompt injection and retrieval trust
- Excessive agency
- Human oversight as a designed process
- Lab: Two tools, one blast radius
- AI application and agent security path
- Landscape: AI application and agent security
- OWASP Top 10 for Agentic Applications 2026 (name only, no Atlas card)
- Outcomes first, then controls (F8a)
- Privacy is not a CIA checkbox
Use the agency page in the sources for the authoritative text.