OWASP LLM Top 10 (2026) mapped to tools

TL;DR:

• The OWASP LLM Top 10 is the canonical risk list for LLM-powered applications, maintained by the OWASP GenAI Security Project.
• Every risk maps to named, testable defences: input/output controls, least-privilege tool scoping, sandboxing, human-in-the-loop, and logging.
• Prompt injection (LLM01) and excessive agency (LLM06) are the two risks most relevant to AI agents and MCP servers.
• Use this hub as your map, then drill into prompt injection explained and MCP security best practices.

What is the OWASP LLM Top 10?

The OWASP LLM Top 10 is a prioritised list of the ten most critical security risks in applications that use large language models. It is published and maintained by the OWASP GenAI Security Project, the same organisation behind the original OWASP Top 10 for web applications. The list exists to give builders a shared vocabulary and a starting checklist for securing LLM systems. Each entry carries an identifier (LLM01 to LLM10), a definition, example attack scenarios, and recommended mitigations. You can read the canonical source at the OWASP LLM Top 10 page.

The list is a prioritisation framework, not a certification. It pairs naturally with the AI agent hardening checklist and with least-privilege for AI agents, which translate these risks into operational controls.

How does each OWASP LLM risk map to a defence?

Each of the ten risks maps to one or more concrete tools or controls. The table below pairs every risk with its short definition, a realistic example, and the defences that mitigate it. The numbers in any example are illustrative, not measured benchmarks.

Risk	Definition (one claim)	Example	Defensive tools / controls
LLM01 Prompt Injection	Untrusted text overrides the model’s intended instructions.	A web page hidden text tells an agent to email its secrets.	Input filtering, prompt/data separation, output gating, spotlighting, allow-listed tools. See prompt injection explained.
LLM02 Sensitive Information Disclosure	The model reveals secrets, PII, or proprietary data in its output.	A chatbot leaks another user’s order history.	Output filtering, data minimisation, retrieval scoping, PII redaction, DLP gateways.
LLM03 Supply Chain	A compromised model, dataset, or dependency introduces risk.	A backdoored model pulled from a public hub.	SBOMs, model provenance checks, signed artefacts, dependency scanning, pinned versions.
LLM04 Data and Model Poisoning	Tampered training or fine-tuning data corrupts model behaviour.	Poisoned documents seed a biased or unsafe response.	Data validation, source vetting, anomaly detection, isolated fine-tuning pipelines.
LLM05 Improper Output Handling	Downstream systems trust model output without validation.	Model output is run as a shell command or SQL query.	Output encoding, parameterised queries, schema validation, treat output as untrusted.
LLM06 Excessive Agency	An agent has more permissions, tools, or autonomy than the task needs.	An agent with delete rights wipes a production table.	Least-privilege scoping, tool allow-listing, human-in-the-loop, read-only defaults. See least-privilege for AI agents.
LLM07 System Prompt Leakage	Secrets embedded in the system prompt are extracted by a user.	An attacker coaxes out an API key placed in the prompt.	Never store secrets in prompts, server-side secret stores, output guardrails.
LLM08 Vector and Embedding Weaknesses	Flaws in RAG retrieval or embeddings enable injection or leakage.	A poisoned document in a vector store hijacks retrieval.	Source authentication, retrieval permissioning, embedding integrity checks.
LLM09 Misinformation	The model produces confident but false or fabricated output.	A legal agent cites a non-existent case.	Grounding/RAG with trusted sources, citation requirements, human review of high-stakes output.
LLM10 Unbounded Consumption	Uncontrolled usage drives cost, denial of service, or model extraction.	A loop of agent calls exhausts the API budget.	Rate limiting, token quotas, cost caps, timeouts, circuit breakers.

For the authoritative definitions of each item, always check the OWASP GenAI Security Project directly, because wording and ordering are revised periodically.

Which OWASP LLM risks matter most for AI agents?

For autonomous agents, LLM01 (Prompt Injection), LLM06 (Excessive Agency), and LLM05 (Improper Output Handling) are the highest-priority risks. Agents act on model output, so a successful prompt injection plus excessive agency equals real-world damage, such as deleted data or exfiltrated credentials. The defensive pattern is layered: separate trusted instructions from untrusted data, scope every tool to the minimum permission, and require a human gate for irreversible actions.

The Model Context Protocol specification is directly relevant here, because MCP servers are the tool layer agents call. Hardening them, as covered in MCP security best practices, is how you close LLM06 in practice.

How do you use this list in a real security programme?

Treat the OWASP LLM Top 10 as a coverage map, then verify each control with tests. A risk is only mitigated when you can demonstrate the control works, not when you have merely named it. A practical sequence:

1. Inventory every LLM, agent, and MCP server in your stack.
2. Map each component to the relevant LLM01 to LLM10 risks.
3. Assign a named control to each mapped risk using the table above.
4. Test each control against a realistic attack, including indirect prompt injection.
5. Log and monitor continuously, because new attack patterns appear faster than annual list revisions.

National guidance reinforces this layered approach. The joint NSA and CISA work on AI system security, available via the CISA AI resources hub, stresses supply-chain integrity (LLM03), data protection (LLM02), and continuous monitoring (LLM10).

Where to go next

Start with the deep-dive companions to this hub: prompt injection explained for the LLM01 attack taxonomy, and MCP security best practices for closing LLM06 at the tool layer. From there, browse the full tools directory, the step-by-step guides library, and the practical checklists collection to operationalise every defence above. You can also return to the site home for the latest tested research.

This hub is maintained against primary sources: the OWASP LLM Top 10, the Anthropic and Claude documentation, and the Model Context Protocol specification.