Standards
OWASP Top 10 for LLM Applications 2026, mapped to agent tests
The OWASP Top 10 for LLM Applications 2026 lists ten risk categories, LLM01 Prompt Injection through LLM10 Improper Output Handling. An Agent Action Pentest exercises the entries that end in an agent action, mainly LLM01, LLM02, LLM03, LLM08 and LLM10. Training, supply chain and model quality entries are out of scope.
What is the OWASP Top 10 for LLM Applications?
It is the OWASP GenAI Security Project's list of the most critical risks for applications built on large language models. The IDs below are from the 2026 edition, published on 2026-08-03 and checked against the published document on 2026-10-14. The previous edition remains at genai.owasp.org/llm-top-10, and the crosswalk below maps each 2025 ID to its 2026 ID.
This page is a mapping, not a claim of certification or official alignment. It shows where our tests touch each entry so you can see what a report covers.
How does each entry map to an agent pentest?
| ID | Name | What an Agent Action Pentest exercises | Scope |
|---|---|---|---|
| LLM01:2026 | Prompt Injection | Direct and indirect payloads that change tool calls. Details | In scope |
| LLM02:2026 | Sensitive Information Disclosure | Data leaving through output, links and tools. Details | In scope |
| LLM03:2026 | Excessive Agency | Every tool, permission and autonomous action. Details | In scope |
| LLM04:2026 | Supply Chain | Third-party models and packages. | Out of scope |
| LLM05:2026 | Data and Model Poisoning | Training and fine-tuning data. | Out of scope |
| LLM06:2026 | Unbounded Consumption | Cost and denial of service. | Out of scope |
| LLM07:2026 | Misinformation | Accuracy of answers. | Out of scope |
| LLM08:2026 | Hidden Context Exposure | Extraction of instructions and hidden context, and what they contain. Details | In scope |
| LLM09:2026 | Vector and Embedding Weaknesses | Embedding store internals. Details | Out of scope, except retrieved content used as an injection channel |
| LLM10:2026 | Improper Output Handling | Model output passed unchecked into tools, links or code. Details | In scope where output reaches a tool or renderer |
Why are some entries out of scope?
A fixed-scope Agent Action Pentest attacks what a deployed agent can do through its tools within 72 hours of access. Supply chain review, training and fine-tuning data audits, embedding store internals and output accuracy need different access and different time budgets. We note them as out of scope so nobody reads the report as covering them. Where an out-of-scope entry creates an action risk, such as poisoned retrieved content that injects instructions, we test the action side under LLM01.
Improper output handling deserves a word. In a chat app it usually means unsanitized HTML or code. In an agent, model output becomes a tool argument, a URL the client renders or a query another system runs, so we treat it as part of the action surface rather than as a separate web test.
How do the 2025 IDs map to 2026?
| 2025 ID | 2025 name | 2026 ID | 2026 name | Change |
|---|---|---|---|---|
| LLM01:2025 | Prompt Injection | LLM01:2026 | Prompt Injection | Same rank |
| LLM02:2025 | Sensitive Information Disclosure | LLM02:2026 | Sensitive Information Disclosure | Same rank |
| LLM03:2025 | Supply Chain | LLM04:2026 | Supply Chain | Down one |
| LLM04:2025 | Data and Model Poisoning | LLM05:2026 | Data and Model Poisoning | Down one |
| LLM05:2025 | Improper Output Handling | LLM10:2026 | Improper Output Handling | Down five |
| LLM06:2025 | Excessive Agency | LLM03:2026 | Excessive Agency | Up three |
| LLM07:2025 | System Prompt Leakage | LLM08:2026 | Hidden Context Exposure | Renamed and broadened |
| LLM08:2025 | Vector and Embedding Weaknesses | LLM09:2026 | Vector and Embedding Weaknesses | Down one |
| LLM09:2025 | Misinformation | LLM07:2026 | Misinformation | Up two |
| LLM10:2025 | Unbounded Consumption | LLM06:2026 | Unbounded Consumption | Up four |
What changed in the 2026 edition?
According to the 2026 document, Excessive Agency climbed to third, which OWASP calls the most consequential move on the list. Unbounded Consumption rose four places, and Improper Output Handling fell from fifth to tenth. Prompt Injection and Sensitive Information Disclosure held first and second.
System Prompt Leakage, LLM07:2025, is now Hidden Context Exposure, LLM08:2026, which the document describes as a broader framing of the same failure. OWASP also folded cross-modal attacks into Prompt Injection and insecure generated code into Improper Output Handling. The document says that once a model acts with tools and memory, the risk moves to the OWASP Agentic Top 10, which is why we also map the agentic threats.
Agent Action Pentest: $2,500 fixed. Written report within 72 hours of access, or a full refund.
See the offer or email yaz@plaw.io
Questions
Does VulnZap certify OWASP compliance?
No. This page maps our tests to the list. There is no OWASP certification for applications, and we do not claim one.
Which edition do you use?
The 2026 edition published by OWASP on 2026-08-03. Our reports show the 2026 ID first and the 2025 ID on a second line where it changed.
Can you cover the out-of-scope entries?
Not inside the fixed $2,500 scope. Email yaz@plaw.io if you need them and we will say what would be required.
Related pages
- 01Prompt injection in AI agentsInstructions in user input or ingested content override what the agent was told to do.
- 03Excessive agency in AI agentsThe agent holds more tools, permissions or autonomy than the task needs.
- 04Sensitive information disclosure through agent actionsCustomer data, secrets or system prompts leave through output, links or tool calls.
- OWASP Agentic AI threats, mapped to agent testsThe OWASP agentic threat taxonomy, T1 to T17, mapped to what an agent pentest covers.
- MITRE ATLAS techniques for AI agentsThe ATLAS techniques that describe attacks on tool-using agents, mapped to our tests.
- AI red teaming vs an agent action pentestBroad AI red teaming compared with a fixed-scope test of agent actions.
Sources
Last reviewed: