OWASP has released the GenAI LLM Top 10 for 2026, updating one of the security community’s key reference points for understanding risk in generative AI applications. 

The new ranking offers a useful snapshot of where AI security priorities are heading. Prompt Injection remains firmly at the top, while risks tied to agency, context and downstream impact have gained prominence. At the same time, familiar risks around data, supply chains, retrieval and output handling remain firmly in view. 

The movement between 2025 and 2026 tells the story.

Prompt Injection is still #1 

For all the change surrounding generative AI, one thing did not move: Prompt Injection remains LLM01. Sensitive Information Disclosure also holds its position at LLM02. 

That persistence matters. AI applications consume instructions and content from increasingly diverse sources, including user prompts, retrieved documents, websites, emails, files, images, tool responses and connected services. Any of those interactions can potentially influence model behavior. 

As AI becomes connected to more data and functionality, the potential impact of manipulation grows with it. Prompt injection remains a foundational problem that security controls need to account for across the AI application, not only at the model interface. 

Agency moves into the top three 

The biggest upward move is Excessive Agency, from LLM06 to LLM03. 

That jump reflects one of the most important developments in AI security over the past year. AI systems increasingly have access to tools, APIs and business systems that allow them to retrieve information and perform tasks. More capability also creates more potential impact when a system is manipulated, operates outside its intended scope or simply makes the wrong decision. 

This connects the LLM Top 10 closely to another important OWASP initiative, the Top 10 for Agentic Applications. Agents introduce planning, tool use, memory and autonomous execution, expanding the security model beyond model behavior to include what the system can access and what it is allowed to do. 

Recent incidents are already showing why that distinction matters. We explored this more closely in AI Agent Security Just Had Its Catalyst Moment, looking at what happens when advanced agents find unexpected paths toward their objectives. 

The rise of Excessive Agency puts that concern near the top of the LLM security agenda.

Context is becoming a security boundary 

Another notable change is the replacement of System Prompt Leakage with the broader Hidden Context Exposure at LLM08. 

The new name better reflects what an AI application can hold in context today. A system prompt is only one element. Context can include retrieved documents, memory, user information, application state, tool responses, internal instructions and other data assembled dynamically during an interaction. 

For security practitioners, this creates a wider set of boundaries to understand and protect: what enters the AI context, where it came from, how it can influence behavior and where that information is permitted to go. 

The change in terminology may look small on the chart. The scope behind it is much larger. 

AI output carries more consequence 

Misinformation rises from LLM09 to LLM07, another change worth watching. 

AI-generated errors have always mattered. Their consequences increase when generated output feeds another application, informs a workflow, produces code or influences an automated action. 

This makes output security broader than model accuracy alone. Security practitioners need to consider how generated content is validated, how much authority downstream systems give it and what controls exist before an output can trigger a consequential action. 

The continued presence of Improper Output Handling, even as it moves down the ranking, reinforces the same point. What happens after generation remains an important part of AI application security. 

The rest of the AI stack still matters 

The updated ranking also provides a useful counterweight to the attention surrounding agents. 

Supply Chain, Data and Model Poisoning, Vector and Embedding Weaknesses, and Unbounded Consumption all remain in the Top 10. 

Modern AI applications are assembled from many moving parts: models, datasets, retrieval systems, libraries, APIs, third-party services and application logic. Weaknesses can enter at multiple points, and they can interact in ways that are difficult to see when each component is assessed in isolation. 

This broader attack surface is already visible in the threat landscape. Recent Check Point Research analysis of AI security threats in 2026 found active probing of exposed AI infrastructure alongside growing data exposure through everyday AI use. 

The 2026 Top 10 reinforces the need to look at the full AI system: the model, its data and context, the surrounding application, connected tools and the actions it can perform. 

Putting the OWASP Top 10 to work 

The value of the OWASP Top 10 is that it gives the security community a shared language for AI risk. Putting it into practice means using that language to understand exposure, prioritize risk and evaluate whether security controls are keeping pace as AI systems change. 

Check Point is proud to sponsor the OWASP GenAI Security Project and support the development of open, practical standards for AI security. 
We also align our approach to these frameworks across Check Point AI Security, including AI Agent Security and Workforce AI Security, helping map AI risk posture to the OWASP Top 10 for both LLM and agentic applications. 

Adversarial testing is another part of that picture. Check Point AI Red Teaming simulates attacks against AI systems and evaluates their resilience against risks covered by the OWASP LLM Top 10. 

Ultimately, frameworks such as the OWASP Top 10 are most valuable when they become part of day-to-day security practice: a consistent way to understand risk, validate defenses and make informed decisions as AI evolves. 

A useful marker for where AI security is heading 

The most interesting part of the 2026 Top 10 is the movement between the rankings. 

Prompt Injection and Sensitive Information Disclosure remain foundational. Excessive Agency has moved sharply upward. Hidden Context Exposure recognizes a broader set of sensitive information flowing through AI systems. Misinformation carries greater weight as generated output becomes connected to real workflows and actions. Risks throughout the AI supply chain remain firmly on the list. 

Taken together, these changes point to a broader view of AI security. Security practitioners need to understand what AI receives, what context it has, what it produces, what it can access and what it is allowed to do. 

The OWASP GenAI LLM Top 10 gives the industry a common language for that work. Its evolution is also a useful signal of where the attack surface is developing and where security practices need to keep pace. 

Explore the full OWASP GenAI LLM Top 10 2026 for the updated risks, examples and mitigation guidance.