OWASP's 2026 Top 10 for LLM Applications: What Changed, and What It Means If You're Building Health Tech

The OWASP GenAI Security Project published the 2026 version of its Top 10 for LLM Applications on 4 August. It's the standard reference for LLM security risks, used by security teams and developers everywhere.

This year's version has had its biggest reshuffle since the list started in 2023.

Checking the vote against the evidence

Every previous version of this list was built on judgement alone. Hundreds of practitioners voted on what mattered most, and that vote is still the backbone of the list.

This year, for the first time, the project checked that vote against real-world evidence too. The team gathered 7,714 incidents from public vulnerability databases and an AI-harm database, sorted out the 6,639 with enough detail to use, and compared them against what practitioners feared most.

The two didn't always match, and where the gap was wide enough, it moved an entry.

The vote still carries three-quarters of the weight in the final list. It's a consensus product built by people who attack and defend these systems for a living, and one noisy year of data shouldn't override that on its own.

Prompt Injection shows the gap clearest. Practitioners rank it the number one risk, and it holds that spot. But look at the raw incident data alone, and it drops out of the top 10 entirely.

Teams fight hard against injection, so fewer clean exploits ever reach a public database. The attack surface behind it exists wherever a model reads text it wasn't handed directly by a developer, which is everywhere. You can't close that off, so the list keeps it at number one.

Misinformation moved the other way. Practitioners voted it near the bottom. The incident data placed it near the top, the widest gap of any entry, in the direction that actually causes harm.

It settled in the middle. When a model's confident, fluent answer drives a decision or triggers a tool call, a wrong answer becomes a wrong action more often than the vote alone assumed.

The bigger reshuffle

Several other risks moved because agentic AI, models that call tools, hold memory, and take actions, has become the dominant way LLMs get deployed.

Excessive Agency made the biggest jump, climbing from sixth to third. Both the vote and the incident record agree that's where the real damage lands.

Unbounded Consumption rose four places to sixth, as running a model or its tools without any spending cap gets more expensive and disruptive.

Improper Output Handling fell the furthest, from fifth to tenth.

One entry changed its identity rather than its rank. System Prompt Leakage is now Hidden Context Exposure, a broader category covering the same problem: trusting information that was never meant to leave the system.

The list, at a glance

1. Prompt Injection. Untrusted input changes how the model behaves in ways you didn't intend. There's no clean fix, so you design the system around the model instead.
2. Sensitive Information Disclosure. The model exposes information it shouldn't, whether through its answers, its reasoning traces, its logs, or even response timing.
3. Excessive Agency. An LLM agent has more functionality, permissions, or autonomy than the job needs, so mistakes cause bigger damage.
4. Supply Chain. The models, adapters, datasets, and tools you build on can be tampered with or swapped out before you ever load them.
5. Data and Model Poisoning. Someone corrupts what a model learns from. It looks fine, until a trigger makes it behave badly.
6. Unbounded Consumption. Nothing stops the model, or its tools, running up a huge bill or grinding a service to a halt.
7. Misinformation. The model produces something confident, fluent, and wrong, and it gets acted on before anyone checks.
8. Hidden Context Exposure. Hidden system prompts and rules get extracted or pieced back together, handing an attacker a map of your system.
9. Vector and Embedding Weaknesses. The retrieval layer behind RAG and AI memory can be poisoned, silenced, or made to leak, without touching the model itself.
10. Improper Output Handling. What the model produces gets used downstream without enough checking, and turns into code execution or an injection attack elsewhere.

Why a few of these land differently in health tech

Most of this list reads as a general security document, and mostly, it is. A handful of entries look different once you're building or buying AI for health tech instead of a general chatbot.

Sensitive Information Disclosure stops being hypothetical when the data behind your model is patient records.

Misinformation looks different again when a confidently wrong answer shapes a clinical summary or a triage decision, not a chatbot reply nobody's relying on.

And Excessive Agency carries more weight once an agent can write back to a patient record or trigger a referral, rather than just suggesting the next step to a human who checks it first.

If you're building AI into a health tech product and want a second pair of eyes on where any of this shows up in your own systems, that's exactly the kind of conversation our AI assurance workshops are built for. Feel free to get in touch or book a call.

Source: OWASP GenAI Security Project, OWASP Top 10 for LLM Applications 2026, released 4 August 2026. Licensed under CC BY-SA 4.0.