OWASP Top 10 for LLM Applications 2026: Securing the System Around the Model

Read the OWASP Top 10 for LLM Applications 2026 with one assumption: the model will be fooled. Test what breaks when it is.

A shopping assistant gets tricked into refunding another customer’s order. In one app, the backend checks order ownership and rejects the request. In another, the payout goes through.

The model behaved the same both times. The difference is the application around it.

This guide walks through the OWASP Top 10 for LLM Applications 2026: each risk, how to test the controls around it, and where Reflectiz agentic web pentesting fits.

What changed in the OWASP Top 10 for LLM Applications 2026

Evidence joins opinion. It’s the first edition backed by incident data: 6,639 classified incidents carry 25% of each ranking, the practitioner vote 75%.

The model will be fooled. Test what breaks.

OWASP’s project leads put it plainly:

“Stop trying to build a model that cannot be fooled. Build the system around it, so that when the model is fooled, and it will be, nothing important breaks.”

That system is a web application: the APIs, access controls, and business rules the model acts through. LLM08 excludes “generic application-security concerns inherited by LLM-integrated systems.” LLM09 calls two critical RAG authentication flaws “out of scope here.”

OWASP’s LLM list scopes out generic application security. Attackers don’t. Agentic web pentesting works in that gap. Scanners fire single requests. Its agents drive a real browser, log in, hold session state, and chain multi-step flows the way an attacker does.

The 2026 list, risk by risk

LLM01:2026 Prompt Injection

What it is. Input that changes a model’s behavior in ways its developers didn’t intend. In 2026, input includes retrieved pages, tool output, images, audio, and memory. Injected instructions run with whatever permissions your application gave the model.

What OWASP recommends. OWASP says “no reliable prevention mechanism exists today,” so limit the blast radius. Keep credentials and state-changing power in code, require human approval for irreversible actions, and treat any agent with untrusted input, sensitive data, and external reach as high risk (the Rule of Two).

Reflectiz fit: Partial. It doesn’t send jailbreak prompts. Its agents test the blast radius inside real sessions: if an API behind the feature returns any order to anyone with its ID (IDOR), one injection reaches every customer’s orders.

LLM02:2026 Sensitive Information Disclosure

What it is. The model or its pipeline leaks confidential or regulated data through replies, tool calls, logs, or embeddings. Most incidents trace to loosely permissioned sources feeding RAG.

Examples. A 2023 ChatGPT caching bug exposed payment details for 1.2% of Plus subscribers. In 2025, Google indexed more than 4,500 shared ChatGPT conversations whose pages lacked noindex directives. DeepSeek left a database with over a million rows of logs and API keys open to the internet.

What OWASP recommends. Send model providers only the fields a task needs, authorize before retrieval down to the chunk, and keep secrets out of system prompts.

Reflectiz fit: Partial. All three incidents are web and infrastructure failures, not model failures. That’s the layer its agents test: broken access control, sensitive data in client-side storage, verbose errors, and missing security headers.

LLM03:2026 Excessive Agency

What it is. An AI system with more functionality, permissions, or autonomy than its task needs, so a manipulated output becomes a real action: deleted data, a sent email, a purchase. OWASP calls its climb “the most consequential move on the list.”

What OWASP recommends. Minimize tools, run actions with the logged-in user’s permissions, require approval for high-impact actions, and “implement authorization in logic rather than relying on an LLM to decide if an action is allowed or not.”

How to test it. OWASP’s example: a chatbot auto-refunds as store credit, while an external payout needs human approval. With controlled test accounts, try to skip the approval, replay it, and change the amount or destination after it’s granted. Agentic web pentesting automates two of these through business logic testing: workflow bypass (skipping the approval) and price manipulation (changing the amount).

OWASP’s AI Agent Security Cheat Sheet sets the bar: “Bind approval to the exact action.” Then test the identity that acts: a customer API can reject someone else’s order while the AI tool’s service account reaches every order.

Reflectiz fit: Strong. Broken access control is the #1 risk on the OWASP Top 10 for web applications, and agentic web pentesting attacks it with real session context: privilege escalation, missing function-level access controls, and IDOR. Server-side tool permissions still need an internal review.

LLM04:2026 Supply Chain

Attackers tamper with models, datasets, or adapters, including a production model that “is not what it claims to be.” AI coding assistants add slopsquatting: they invent package names that attackers register first. Mitigations: an AI bill of materials, model signing, and pinning artifacts by digest.

Reflectiz fit: Out of scope. The web supply chain is a separate risk, A03 on the OWASP Top 10:2025, and Reflectiz Security Hub covers its browser-side slice.

LLM05:2026 Data and Model Poisoning

Attackers plant backdoors or biases through training, fine-tuning, embedding, or retrieval data. OWASP cites research in which 250 poisoned documents compromised models from 600 million to 13 billion parameters. Mitigations: data provenance, input validation, and red teaming for hidden triggers.

Reflectiz fit: Partial. Training data is out of reach. Retrieval poisoning isn’t: its agents test whether users can change content your AI ingests without permission.

LLM06:2026 Unbounded Consumption

Attackers exploit LLM cost and compute: request floods, denial-of-wallet attacks, and mass querying to copy a model. In OWASP’s example, a long agent session’s per-turn cost climbs from about $0.001 to about $0.50 by turn 100 without tripping a rate limit. Mitigations: token-based limits, hard budget caps, and step limits on agents.

Reflectiz fit: Partial. Its agents test rate limiting on logins, including credential stuffing exposure. Token budgets and spend caps stay in your API gateway.

LLM07:2026 Misinformation

A model gives a wrong but credible answer, and someone acts on it. As the project leads put it, “a wrong answer turns into a wrong action.” Mitigation: “Separate generation from execution and verify claims before acting.”

Reflectiz fit: Indirect. It can’t judge answers, but its business logic tests confirm that server-side rules, such as refund limits, still hold.

LLM08:2026 Hidden Context Exposure

What it is. The renamed System Prompt Leakage, now covering anything the model sees but users shouldn’t: system prompts, developer instructions, policy text, and tool schemas. OWASP’s rule: “design under the assumption that hidden context is discoverable.” Keep secrets out of it, and never let the model enforce authorization.

Reflectiz fit: Partial. Its agents test whether permission limits hold once the prompt is out, and whether your front end ships prompts, tool configuration, or API keys to the browser.

LLM09:2026 Vector and Embedding Weaknesses

What it is. RAG systems retrieve your documents by meaning, which makes the vector store a security boundary. OWASP’s frame: “poisoning makes the system wrong, inversion makes it leak, jamming makes it silent, and access-control failure makes it indiscriminate.” Enforce tenant scope on the server, because “a client-supplied scope is a suggestion, not a control.”

How to test it. Swap the tenant or document ID in a request, keeping the session. Then run three checks from OWASP’s RAG Security Cheat Sheet:

• Revoked access: remove a test user’s access, then query. Old excerpts and cached answers shouldn’t return.
• Deletion: a deleted document’s chunks, embeddings, and cached responses should go too.
• Every surface: check results, previews, citations, and attachments, not just the answer.

Reflectiz fit: Partial. Inversion, poisoning, and jamming are beyond application-layer testing. The access-control layer isn’t: its agents swap tenant IDs inside real sessions and catch any that return someone else’s data.

LLM10:2026 Improper Output Handling

What it is. Model output passed downstream without validation or encoding, causing XSS and CSRF in the browser or SSRF and code execution on the backend. Its scope now “spans the insecure code that assistants generate at scale.” OWASP’s fixes: treat output as untrusted, encode it, parameterize queries, and deploy a strict Content Security Policy (CSP).

How to test it. Test every place model output lands:

• Chat renderer: an XSS test on your contact form says nothing about the chatbot. CSP is “an additional layer of defense,” per OWASP’s XSS Prevention Cheat Sheet, not the primary one.
• Auto-loaded resources: an image in model output can send data to an outside domain with no JavaScript.
• Server-side requests: allowlist destinations, validate resolved IPs, and disable redirects, per the SSRF Prevention Cheat Sheet.

Reflectiz fit: Strong. Model output is untrusted input, so its flaws are classes its agents already hunt on every endpoint they map: XSS, SQL and command injection, SSRF, and missing security headers. Most teams pentest once or twice a year. Continuous agentic pentesting tests every release, because AI-assisted code ships weekly and attackers use AI to find its flaws.

Which OWASP LLM risks can agentic web pentesting test?

The AI widget on your page is third-party code

Many site chatbots load as third-party code in your visitors’ browsers. Reflectiz Security Hub monitors that layer from the outside. Reflectiz research found that 64% of third-party applications access sensitive data without a business justification. Security Hub shows which fields an AI widget reads and where it sends them, flags missing or malformed CSP, and detects vendor code changes. It doesn’t see individual chat sessions.

What the rest of your AI security program needs

Agentic web pentesting covers the application layer. You also need:

1. Red teaming of the deployed AI workflow, guided by OWASP’s GenAI Red Teaming Manual (October 2026). Test adaptively: in Nasr et al. (2025), adaptive attacks beat most of 12 recent defenses more than 90% of the time.
2. Data governance for training, fine-tuning, and retrieval data.
3. The OWASP Top 10 for Agentic Applications for AI that acts on its own.
4. Expert manual pentesting for novel attacks.

Test the system around your model with agentic web pentesting

Start with one AI workflow that can expose data or move money:

1. Trace it from the user’s request through retrieval, tool calls, and execution.
2. At each boundary, name the service that enforces the rule and the identity it trusts.
3. Define the unauthorized outcome, such as an unapproved payout.
4. Prove the application rejects it, with controlled accounts and records.

Reflectiz agentic web pentesting attacks every endpoint it maps, for every check in its playbook. A validator agent reproduces each finding, and a coverage matrix proves what was tested and ruled out. That’s up to 10x the testing capacity of a manual pentest, at the same cost.

See how agentic web pentesting tests the applications behind your AI features.

Sources

• OWASP Top 10 for LLM Applications 2026, August 2026 (release page, PDF)
• OWASP Top 10 for Agentic Applications, December 2025
• OWASP GenAI Red Teaming Manual v1.0, October 2026
• OWASP Top 10:2025
• OWASP cheat sheets: AI Agent Security, RAG Security, XSS Prevention, SSRF Prevention
• Nasr et al., The Attacker Moves Second, October 2025
• A small number of samples can poison LLMs of any size, Anthropic and partners, October 2025
• Wiz, Exposed DeepSeek database, January 2025