OWASP / LLM Top 10 2026

Risk that input reaching the model — direct user input, retrieved content, tool output, image, audio or video content, intermediate reasoning, or persistent memory — alters the model's behaviour in ways the application developer did not intend, because the model draws no architectural boundary between instructions and data. Consequences include disclosure of sensitive information and system-prompt content, attacker-chosen output that downstream systems or users act on, unauthorised invocation of tools escalating to arbitrary command execution, covert exfiltration through image-URL or invisible-character channels, and persistent compromise of behaviour across sessions through memory or RAG corpus poisoning.

Ensure that the system prompt constrains the model's role and capabilities using declarative allow and deny statements rather than open-ended grants. This is a partial control only: an attacker who infers the prompt can bypass it, so it must be paired with the privilege controls that hold credentials and state-change capability outside the model.

Ensure that untrusted content is inspected before it reaches the model at every modality boundary — text, image, audio, and structured data — by running modality-specific classifiers, OCR over images and transcription over audio, and then applying text filters to the extracted content. Semantic filters remain evadable by rephrasing, encoding, and low-resource or code-mixed inputs, so this control reduces rather than removes injection success.

Ensure that a strict output schema is defined and that every model response is validated structurally in trusted application code — rather than by a second LLM call — before any downstream system acts on it. Structural validation catches format violations but not semantic manipulation, so it must be combined with downstream output handling controls.

Ensure that credentials and the ability to change state are held in application code rather than by the model, with least privilege granted per operation, and that privileged calls are routed through a deterministic policy engine that re-validates intent and arguments at execution time. Broad "convenience" permissions and multi-agent hops re-introduce the risk downstream.

Ensure that explicit human confirmation is required before any privileged, irreversible, or externally visible action, and that the reviewer is shown the exact rendered action rather than a summary of it. Invisible-character smuggling can otherwise make the displayed action differ from the executed one, and approval fatigue degrades reviewer judgement at volume.

Ensure that injection defences are tested against adaptive attackers who have read the deployed defence specification, using recognised baselines such as AgentDojo and JailbreakBench before red-teaming with the full defence disclosed to testers. Static-only attack-success claims must be rejected as evidence of resilience.

Ensure that deployed guardrails, safety filters, and content moderation systems are themselves subjected to regular adversarial bypass testing — including character injection, encoding obfuscation, multilingual and low-resource-language attacks, and multi-turn manipulation — to verify that protections cannot be circumvented. Having guardrails in place is not sufficient if those guardrails can be bypassed.

Ensure that tag-block, variation-selector, and zero-width Unicode characters are stripped at every ingest and render boundary. These characters are invisible in normal rendering and are used both to smuggle instructions into the context window and to carry exfiltrated bytes out of it. Stripping does not stop visible-text payloads or future steganographic classes.

Ensure that externally sourced content is passed to the model through a structurally separate, provenance-labelled channel so that the model can distinguish data from instructions. This reduces attack success in non-adaptive testing only: an attacker who knows the marking scheme can mimic it, so the control must not be relied on as a trust boundary.

Ensure that agent capability combinations are explicitly budgeted, treating simultaneous access to untrusted input, sensitive data, and state change or external communication as high-risk. Agents holding all three require per-action human approval, and agents holding two require a documented residual-risk assessment.

Ensure that writes to persistent agent memory are treated as privileged operations: the causing prompt is logged, writes are classified for instruction-bearing or role-modifying content, and approval is required before such memories persist across sessions. Factual entries shade into instructions and incremental writes can evade per-write classification, so this control requires ongoing review.

Risk that an LLM-integrated system exposes confidential, regulated, privileged, or proprietary data through a channel the data subject, controller, or system owner did not authorise. Disclosure surfaces extend well beyond the final answer to tool-call arguments, reasoning traces, retrieved chunks, multimodal output, logs, telemetry, embeddings, and observable inference properties such as timing, token length, log-probabilities and cache-hit behaviour. Disclosure arises at training time through memorisation, at inference time through live context, at pipeline time through derived artefacts, and at observation time through side channels, resulting in privacy violations, regulatory breach and erasure obligations, and intellectual property loss.

Ensure that training corpora are governed for provenance and classification, deduplicated across near-duplicates, transliterations and format variants, and scrubbed of personal data at ingest. Deduplication reduces but does not eliminate memorisation, so it must be paired with extraction testing.

Ensure that only task-required fields are sent to external providers, that automatic context expansion is disabled unless justified per template, and that document- and chunk-level authorisation is enforced inside the index query rather than at the application layer after retrieval. Per-tenant indexes should be isolated for high-sensitivity workloads.

Ensure that data retention, usage, and deletion commitments — including no-train and no-retain undertakings given to customers — are enforced through technical configuration rather than contractual or policy text alone, and that data is encrypted in transit and at rest.

Ensure that secrets, credentials, connection strings and regulated data are never stored in system prompts or other hidden context, and that internal configuration details are not exposed to end users through error messages or settings.

Ensure that reasoning traces, tool-call arguments, and other non-answer channels are classified and redacted under the same rules as the final answer, and that raw traces are never written to unrestricted observability. Sanitisation must combine pattern matching, named-entity recognition and trained classifiers, because regular expressions and blocklists fail on encoded and cross-lingual output.

Ensure that observable inference properties cannot be used to reconstruct content or infer membership: gate log-probabilities, confidence scores and explanations on production endpoints, apply random padding and token batching to streaming responses, and partition or segregate prefix and KV caches under co-tenancy.

Ensure that observability and APM pipelines do not become a disclosure surface: logs and traces must be restricted and scrubbed before ingestion, since LLM observability platforms log full prompts, completions, retrieved chunks and traces by default and expose them to everyone with dashboard access.

Ensure that per-user and per-session query budgets are applied to sensitive endpoints in order to disrupt enumeration, extraction and membership-probing campaigns. Open-weights deployments cannot rely on rate limits alone, since extraction and inversion run offline at unbounded rates.

Ensure that erasure requests are satisfied across raw data, embeddings, checkpoints and adapters — not only the source record — and that erasure is validated by post-unlearning extraction and membership-inference probes. Data that has influenced weights, embeddings or adapters remains extractable after source deletion, straining statutory erasure obligations.

Ensure that disclosure red-teaming is a gate on release rather than a periodic exercise, quantitatively measuring extraction, membership inference, embedding inversion, internal-state inversion, side channels and adapter extractability, with results aligned to a recognised adversarial taxonomy.

Risk that LLM-based systems are granted excessive functionality, permissions, or autonomy beyond what is necessary for intended operations, enabling damaging or unauthorised actions — including data exfiltration, system manipulation, and privilege escalation — in response to hallucinated, manipulated, or ambiguous model outputs. Triggers include confabulation from benign but poorly engineered prompts, direct or indirect prompt injection, and compromised tools or peer agents in multi-agent systems.

Ensure that LLM agents are granted access only to the tools and functions strictly necessary for their intended operation, that open-ended tools such as shell execution or arbitrary URL fetching are avoided in favour of granular purpose-built tools, and that tools define a strict schema for input parameters and validate contents prior to use.

Ensure that permissions granted to LLM tools on downstream systems are limited to the minimum required for intended operations, enforced through appropriate access controls at the downstream system — for example table-level database permissions or narrowly scoped OAuth grants — rather than by convention.

Ensure that human-in-the-loop controls are in place requiring explicit human approval before the LLM or its tools execute high-impact or irreversible actions, implemented either within the tool itself or in the downstream system.

Ensure that authorisation is implemented in logic rather than delegated to the LLM, and that every request to a downstream system is validated against security policy by the tool, an independent pre-execution policy decision point, or the downstream system itself. Enforcement should be graduated — audit, warn, block, escalate — so that low-consequence or reversible actions may auto-approve while high-consequence or irreversible actions route to human review.

Ensure that prior to deployment, the potential blast radius of each LLM system is documented and reviewed — enumerating all connected tools, identities, data sources, external APIs, and downstream systems the LLM system can reach. Design boundaries should limit the maximum scope of impact from a compromised or misbehaving LLM system, and the blast-radius assessment should be repeated whenever LLM system capabilities or integrations change.

Ensure that actions taken on a user's behalf are executed on downstream systems in the security context of that specific user and with the minimum privileges necessary, rather than through a generic high-privilege service identity. In delegated or multi-agent workflows the original user context and authorisation scope must be preserved across chained tool or agent calls rather than relying on the permissions of the calling agent.

Ensure that the activity of LLM tools and downstream systems is logged and monitored to identify undesirable actions, and that thresholds and circuit breakers halt, rate-limit, or escalate for human review when exceeded. Thresholds should be context-aware, bounding the cumulative value of tool parameters and not only the number of invocations.

Risk that vulnerabilities in third-party components, pre-trained models, datasets, fine-tuning adapters, conversion and merge pipelines, MCP servers, tool plugins, or deployment platforms — including tampering, poisoning, malicious artefact replacement, or inadequate provenance — compromise the integrity, security, or legal compliance of LLM applications, resulting in biased or malicious outputs, system failures, and regulatory exposure. Model artefacts, provenance, and conversion/merge workflows are now first-class attack surfaces, and on-device deployment widens the surface further.

Ensure that all data sources, model providers, and software suppliers are rigorously vetted, including review of terms and conditions and privacy policies, and that their security posture is regularly re-assessed and re-reviewed whenever it or their terms change.

Ensure that a signed, up-to-date inventory of all components is maintained using a Software Bill of Materials, extended to models, adapters and datasets through AI BOMs and ML SBOMs, and that licences are tracked in the same inventory and audited regularly for compliance and transparency.

Ensure that models are sourced only from verifiable sources and that weak provenance is compensated for with third-party integrity checks, file hashes, and cryptographic model signing backed by a transparency log binding the artefact to a signer identity. Signing proves integrity and origin but not safety, so it must be combined with immutable artefact references, provenance policy, policy-based release gates, behavioural evaluation, and continuous validation of upstream model integrity.

Ensure that AI red teaming and evaluation focused on the use cases in scope is performed on any third-party or open-access model before it is approved for deployment, and that results are documented as part of the model onboarding process.

Ensure that AI applications in production remain subject to ongoing anomaly detection and adversarial robustness testing within MLOps and LLM pipelines, so that tampering, poisoning, and emerging attack techniques are detected after deployment and remediated through a formal process.

Ensure that all Model Context Protocol (MCP) servers, tool plugins, and external agent integrations are pinned, signed, and verified before use, that tool descriptions are audited for hidden instructions, and that tool composition is monitored at runtime. Pinning does not stop a payload shipped in the pinned version or tool-description poisoning that leaves the version unchanged.

Ensure that models, adapters, datasets, fine-tuned checkpoints and conversion outputs are resolved by immutable digest rather than by mutable reference such as a `latest` tag or an `Author/ModelName` identifier, and that the promotion boundary where automated pipelines accept artefacts into trusted environments enforces signature and hash verification. Name-based resolution is exploitable through namespace reuse once an upstream account is deleted or transferred.

Ensure that collaborative model development environments are strictly monitored and audited, and that model conversion, merge and quantization workflows are treated as high-risk promotion points requiring re-verification of the resulting artefact. Assurances obtained on a full-precision model do not transfer to a quantized artefact, since weights can be crafted so the full-precision model evaluates benignly while the quantized artefact exhibits attacker-chosen behaviour.

Ensure that dependencies suggested by LLM coding assistants are verified to exist and to be the intended package before adoption, because assistants hallucinate plausible but nonexistent package names at scale and attackers pre-register those names so that unverified suggestions resolve to malicious code.

Ensure that malware scanners, safe serialisation formats and safe-loader flags are treated as defence-in-depth layers rather than guarantees, and are accompanied by provenance verification and patched loaders and parsers. Corrupted or compression-wrapped streams, scanner and safe-loader bypasses, and computational-graph backdoors in formats widely considered safe all evade these checks.

Risk that an adversary or an unsafe process manipulates data or model artefacts to embed harmful behaviour, bias, or exploitable weaknesses into an AI system. Poisoning is not confined to training data: it can occur anywhere data is ingested, transformed, retrieved, or reused — during pre-training, fine-tuning, embedding creation, retrieval augmentation, and model distribution — and can be carried by bundled non-weight artefacts such as chat templates, tokenizer configs, adapters and quantization artefacts. Backdoors may leave behaviour untouched until a trigger fires, producing a system that appears functional while undermining trust, safety, and security.

Ensure that dataset and model lineage is tracked using an SBOM or ML-BOM, that signing and verification are enforced on artefacts, and that data integrity is continuously validated across lifecycle stages. Incoming data must be strictly validated, third-party vendors vetted, and outputs compared against trusted sources to detect adversarial manipulation early.

Ensure that sandboxing and strict isolation limit model interaction with unverified data, tools, or external systems, and that statistical and AI-based anomaly detection is applied across training, embedding, and inference pipelines to surface poisoning effects that emerge gradually.

Ensure that model training and fine-tuning pipelines implement integrity controls across three dimensions: (i) data provenance verification confirming that all training data is from authorised and unmodified sources; (ii) anomaly detection on training metrics — including loss curves, gradient norms, and output distributions — to detect signs of poisoning; and (iii) version-controlled dataset management enabling detection and rollback of unauthorised modifications.

Ensure that chat templates, tokenizer configurations, LoRA and PEFT adapters, and quantization artefacts shipped alongside model weights are treated as security-relevant code, with signing, hash verification, diff checks and static analysis enforced before deployment. These non-weight artefacts can carry trigger-activated conditional instructions that leave benign-input behaviour unchanged.

Ensure that automated retraining and feedback loops validate incoming data, require human oversight, and apply rate limits, so that an attacker with nothing more than ordinary user-interface access cannot gradually shape model behaviour through manipulated preference signals.

Ensure that models are continuously red teamed with adversarial inputs and trigger-based prompts to identify hidden backdoors, and that dedicated trigger-probing is repeated after every alignment cycle. Safety alignment must not be assumed to remove backdoors, as they can persist through standard safety training.

Risk that LLM applications permit excessive or uncontrolled inference operations, enabling adversaries to disrupt service availability, inflict unsustainable financial costs ("Denial of Wallet"), or steal intellectual property through model cloning. The defining characteristic is cost asymmetry: an attacker triggers disproportionately expensive computation at negligible cost to themselves. Extended-thinking models with unconstrained output budgets, multimodal inputs, agentic architectures and tool-use protocols that fan a single request into cascading downstream operations, and shared inference infrastructure all amplify the exposure, and request-rate limiting alone is no longer sufficient.

Ensure that rate limiting and per-user or per-application quotas extend beyond requests per second to tokens-per-minute, tokens-per-day, and estimated cost per request, and that pre-flight token estimation rejects requests before inference begins. Primary ownership rests with infrastructure and platform teams; AI application teams should verify that such controls are configured and actively monitored for their workloads.

Ensure that input size limits are enforced to reject requests exceeding reasonable token or byte thresholds, preventing resource exhaustion from variable-length input flooding, context accumulation, or near-limit large-context abuse. This control is typically implemented at the API gateway or LLM proxy layer and owned by infrastructure teams; AI application teams should confirm limits are in place and calibrated for their workload.

Ensure that resource usage — including token consumption, request rates, and cost metrics — is continuously monitored with cost-attribution and anomaly detection, and that agent-tool interactions are baselined so that recursive or resource-intensive sessions without a clear end state are identified.

Ensure that the LLM application's access to network resources, internal services, and APIs is restricted through sandboxing and network segmentation, constraining an attacker's ability to exfiltrate extracted model information or data to an external destination.

Ensure that non-overridable budget ceilings are set per API key, user, team, and cloud account, and that these are enforcement mechanisms which halt inference when exceeded rather than alerting thresholds that fast-accumulating workloads can outpace. Caps must account for cost differences between modalities and tool protocols.

Ensure that every agent execution is bounded by step limits, recursion depth limits, time limits, and per-run cost ceilings, with state hashing used to detect recursive loops. These bounds are the only defence against short, benign-looking prompts that drive extended-thinking models into prolonged or non-terminating reasoning loops, since such prompts bypass input-size validation entirely.

Ensure that LLM serving frameworks are kept updated, that unsafe deserialisation is disabled and special-token passthrough restricted, and that authentication is enforced on all inference endpoints, so that the serving stack itself cannot be used to crash the service or exhaust model resources.

Risk that an LLM or LLM-enabled application produces incorrect, incomplete, unsupported, or misleading output that appears credible enough to influence a human decision, an automated workflow, or an agent action, and that the incorrect output is then trusted and acted upon. Because model outputs drive tool calls, generate code, infer system state, authorise actions and coordinate across agents, misinformation is a system-level failure that can lead to financial loss, security incidents, safety risks, or operational disruption. Causes include hallucination, stale or incomplete context, weak grounding, ambiguous prompts, misleading summaries that omit critical constraints, and unvalidated tool outputs; overreliance on fluent, confident output is frequently embedded in system design.

Ensure that outputs which drive decisions or actions are grounded in authoritative and current sources — for example through Retrieval-Augmented Generation over verified knowledge — rather than relying on the model's parametric knowledge alone.

Ensure that verified facts are distinguished from assumptions in anything surfaced to a human or a downstream system, and that human oversight and cross-verification processes are in place for critical or sensitive content, countering the tendency to treat fluent, confident or well-structured output as authoritative.

Ensure that approval workflows and automated system checks verify model assertions at runtime before high-impact actions are executed, particularly in high-stakes environments such as healthcare, legal and financial services.

Ensure that generation is architecturally separated from execution, so that claims produced by the model are verified against authoritative state before any action is taken on them, rather than allowing a fluent assertion to flow straight into a tool call or workflow transition.

Ensure that tool invocations are validated before execution by checking arguments, authorisation, preconditions, and current real-world state, so that an incorrect state inference by the model — concluding that a condition has been met when it has not — cannot trigger an unintended action.

Ensure that decisions about whether a claim can be trusted are driven by verification signals such as groundedness and consistency checks, not by the model's self-reported confidence, which is not a reliable indicator of correctness.

Ensure that outputs are structured with mandatory fields so that omissions are detectable, preventing summaries that silently drop key constraints, exceptions, timestamps, contraindications or risks from being treated as complete.

Ensure that claims, supporting evidence and resulting outcomes are logged so that misinformation can be traced and tracked over time, and that workflows are regularly tested against deliberately misleading and adversarially induced scenarios.

Risk that hidden, non-user-facing system instructions or operational context placed in a model's context — the system prompt, developer instructions, retrieved policy text, tool and function schemas, and other assembled rules and directives — are extracted, inferred, or reconstructed by an attacker. It becomes security-relevant when that context contains or reveals secrets, policy logic, tools, trust boundaries, workflow criteria, or proprietary behaviour that materially increases attacker capability, ranging from informational exposure through to embedded credentials or reliance on hidden-context secrecy for authorisation.

Ensure that credentials, secrets, connection strings and security-critical configuration are never embedded in system prompts or other hidden context, and that such information is externalised to systems the model does not directly access. All context available to the model must be assumed to be available to users.

Ensure that critical controls such as privilege separation and authorisation bounds checks are never delegated to the LLM, whether through the system prompt or any other mechanism, but are enforced in a deterministic and auditable manner outside the model. Where tasks require different levels of access, they must be separated by authorisation context and granted only the privileges they require.

Ensure that behaviour control and content safety are enforced through independent, deterministic systems outside the model rather than by instructions embedded in hidden context. Fine-tuning may reduce the likelihood of disclosure but provides no consistent guarantee and can have unintended consequences.

Ensure that tool and function schemas, permission and role directives, refusal criteria, and output structure or formatting rules carried in hidden context are designed on the assumption that they are discoverable. Their disclosure must not by itself grant capability: tool access must be independently authorised, refusal behaviour independently enforced, and downstream parsers must not assume that a schema-conformant response carries trustworthy values.

Risk that weaknesses in the generation, storage, or retrieval of vectors and embeddings are exploited wherever similarity search sits between a data source and the prompt — in Retrieval-Augmented Generation, vector-backed agent memory, semantic caches, and deduplication pipelines. These attacks exploit the geometry of the embedding space rather than the model's instruction-following behaviour, and include cross-tenant leakage through shared similarity search, embedding inversion that reconstructs source text, retrieval-time poisoning, retrieval jamming that denies service, membership inference, semantic-cache and deduplication poisoning, and multimodal embedding poisoning — resulting in privacy violations, compliance failures, and compromised model integrity.

Ensure that tenant scoping is enforced inside the index query and validated server-side, rather than applied as a post-retrieval filter — because similarity search that runs across the full index before access control leaks existence, topic and volume through result counts, score distributions and timing even when no document is returned. Access control must be applied at chunk level, embedding and similarity-search endpoints authenticated as first-class APIs with per-tenant rate limits, and physically separated indexes used for high-sensitivity workloads.

Ensure that content is normalised before embedding — stripping zero-width characters, white-on-white text and Unicode homoglyphs at extraction — that provenance is tracked for every embedding so compromised batches can be invalidated and audited, and that externally sourced content destined for sensitive indexes is human-reviewed. The embedding model itself must be vetted, since a backdoored encoder corrupts the geometry of everything ingested.

Ensure that immutable logs of retrieval activity are kept — tenant scope, query, returned identifiers and similarity scores — and monitored for tenant-filter bypass attempts, cross-tenant anomalies and abnormal embedding-API consumption. Incident-response playbooks must treat an "embeddings only" leak as a leak of the underlying source documents for breach assessment and notification purposes.

Ensure that mixed-trust content — external web data, internal confidential documents, and partner data — does not share an index without hard isolation. Index-level segregation is preferred over classification tags on a shared index because it removes the misconfiguration path entirely.

Ensure that new vectors sitting unusually close to a wide range of common queries are flagged as the signature of retrieval-hijacking poisoning, and that queries returning too many high-similarity matches, unusual embedding-endpoint volume, and unexpected cluster growth after ingest are monitored. Raw similarity scores must not be returned to clients, noise and diversification should be applied at the ranking layer, and endpoints that could be queried as membership or inversion oracles must be rate-limited.

Ensure that embeddings are deleted within a bounded time when their source document is deleted and that reconciliation audits verify it; that vector-database backups are held at the same sensitivity tier as source documents; that embeddings are encrypted at rest with keys managed separately from the application layer; that the corpus is re-embedded rather than mixed when rotating embedding models; and that embedding-API keys are treated as secrets.

Risk that LLM-generated outputs are passed to downstream components or systems without sufficient validation or sanitisation, enabling cross-site scripting (XSS), cross-site request forgery (CSRF), server-side request forgery (SSRF), SQL injection, path traversal, privilege escalation, or remote code execution. The exposure extends to sinks that interpret control characters — terminals, log viewers and IDE panes rendering ANSI escape sequences — to client renderers that automatically fetch external resources referenced in model output, and to insecure code that assistants generate and applications deploy at scale.

Ensure that LLM outputs are treated as untrusted input when passed to backend functions, APIs, or other system components, applying proper validation and context-aware output encoding for the sink in question — HTML encoding for web content, JavaScript encoding for script contexts, parameterised queries or prepared statements for all database operations — following OWASP ASVS guidance. LLM output must never be executed or forwarded to a sensitive sink without this treatment, and strict Content Security Policies should be applied to limit the impact of injected markup.

Ensure that logging and monitoring systems are deployed to detect unusual patterns in LLM outputs that may indicate exploitation attempts against downstream handling.

Ensure that ANSI escape sequences, BEL, OSC, backspace, carriage return and other non-printable bytes are sanitised from model output before it is written to terminals, log files, IDE panes or other interpreting sinks, and that they are encoded visibly where they must be preserved. Unhandled control characters enable visual spoofing, clipboard hijacking and exploitation of terminal emulator vulnerabilities.

Ensure that chat UIs, IDEs, email clients and mobile apps do not allow model output to trigger automatic outbound requests to attacker-controlled endpoints. Auto-rendering of Markdown images, link previews and iframes should be disabled by default; where rendering is required, fetches must be restricted to an explicit allowlist of origins or proxied through a server-side fetcher that strips data-bearing query parameters.

Ensure that code generated by an LLM is subject to human review and security testing before it is compiled and deployed, so that automated build-and-release pipelines do not treat generated output as trusted and push insecure code into production at scale.