OWASP Top 10 for LLM and Agentic Applications

0:00 OWASP Top 10 for LLM and Agentic Applications

When a client's security team asks, have you tested for LLM zero one, they are speaking the language of the OWASP Top 10 for LLM Applications. In this lecture you will learn that list, what changed in the twenty twenty-six edition released in August, the separate Top 10 for Agentic Applications, and how to turn both into a coverage matrix that proves you have actually tested what matters.

0:30 Analogy: the pre-flight checklist

Why learn a list at all? Here is an analogy. A pilot's pre-flight checklist does not teach anyone to fly. But it guarantees that nobody forgets the fuel, the flaps or the doors, however experienced or tired they are. The OWASP lists are pre-flight checklists for LLM applications. They will not design your system for you, but they make sure nobody on your team forgets an entire category of risk, and they give you a shared language with clients, auditors and vendors.

1:06 2025 edition

The OWASP GenAI Security Project publishes the Top 10 for LLM Applications, the most widely referenced list of LLM app risks. The twenty twenty-five edition runs: prompt injection; sensitive information disclosure; supply chain; data and model poisoning; improper output handling; excessive agency; system prompt leakage; vector and embedding weaknesses; misinformation; and unbounded consumption.

1:29 2026 edition (Aug 2026)

In early August twenty twenty-six, OWASP released the twenty twenty-six edition. No categories were added or removed, but most moved. The ranking method also changed: it now combines the community vote with analysis of a large corpus of real-world incidents. Prompt injection stays at number one, with its scope expanded to cross-modal attacks, like instructions hidden in images or audio, and to injections that persist in memory or a retrieval corpus. Sensitive information disclosure stays at two.

2:02 Key 2026 moves

Three moves stand out. Excessive agency rises to number three, reflecting how many agents now hold real permissions. System prompt leakage is renamed hidden context exposure, at number eight, widening it to everything the app shows the model but not the user: retrieved documents, tool definitions, memory and configuration. And improper output handling drops to number ten. The full reported order is on screen and in your lesson text. Verify against the official document before quoting it in contracts.

2:36 Always cite the edition

Because numbering changed, always write the edition with the identifier, for example LLM zero eight colon twenty twenty-six, hidden context exposure. Many tools, reports and contracts still use twenty twenty-five numbers, so keep a mapping table in your security documentation. Otherwise, two teams can discuss LLM zero three and mean completely different risks.

2:59 Agentic Top 10 (ASI01–ASI10, Dec 2025)

For agents, there is a separate list. In December twenty twenty-five, the same project published the Top 10 for Agentic Applications, identified as A S I zero one to ten. It covers agent goal hijack, tool misuse and exploitation, agent identity and privilege abuse, agentic supply chain compromise, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading agent failures, human-agent trust exploitation, and rogue agents. Use it alongside the LLM list for any system that plans, remembers and acts.

3:34 Use them well

How should you use these lists? As a coverage checklist, not a complete threat model, because your system can have risks outside both, like business logic abuse of a discount tool. Map each item to concrete red-team tests and to controls in your architecture. And link items to your own threat-model identifiers so findings reports use shared language. Beware checkbox compliance: saying we considered prompt injection without tests is not coverage.

4:05 Case: UK fintech coverage matrix

A worked example. A UK fintech preparing for a client security review built a coverage matrix from the twenty twenty-six items plus relevant agentic items. Two gaps appeared at once. Their retrieval index was shared across tenants with filtering applied only after retrieval, a vector and embedding weakness. And their agent stored user preferences that any conversation could overwrite, a memory poisoning risk. Both were fixed before the review.

4:35 Drill: a RAG chatbot vs the 2026 list

A simple example of using the list for coverage. Take a customer-support chatbot with retrieval but no tools. Walk down the twenty twenty-six list. Prompt injection: applies, through retrieved documents. Sensitive information disclosure: applies, order data. Excessive agency: barely, no tools yet. Supply chain: applies, your model provider and packages. Poisoning: applies to the knowledge base. Unbounded consumption: applies. Misinformation: applies to policy answers. Hidden context exposure: applies to the system prompt. Vector and embedding weaknesses: applies to the index. Improper output handling: applies to the chat UI. Ten minutes, and you know where your tests should go.

5:18 Scenario: the bank's questionnaire

And a realistic procurement moment. A bank in Abu Dhabi sends your agency a vendor questionnaire asking how you address the OWASP Top 10 for LLM Applications. A weak answer says, we follow OWASP best practices. A strong answer attaches your coverage matrix: each item with the edition year, how it manifests in the delivered system, the controls in code, the red-team test identifiers and the date last tested. That second answer wins contracts, and it also forces you to actually do the work.

5:55 Deeper: answering a 2025-based form

One level deeper on edition mapping. A client's 2025-based questionnaire asks about LLM zero seven, system prompt leakage. In your 2026-based matrix, that is LLM zero eight, hidden context exposure, which is broader. Answer with both IDs and note the broader 2026 scope. That shows you are current without making the client redo their form.

6:19 Watch me do it: coverage matrix

Watch me do it: filling the coverage matrix for a RAG support agent that can also create refunds. Row LLM zero one, twenty twenty-six, prompt injection. Applies: yes. How it manifests: customer messages, plus retrieved reviews and emails. Controls: spotlighting of retrieved content, a tool allowlist per route, no general internet egress. Tests: red-team cases RT zero one to RT zero nine. Last tested: this month. Owner: the security lead. Row LLM zero three, excessive agency. Applies: yes, because of the refund tool. Controls: a cap in code, a per-customer limit and human approval above a threshold. Tests: RT twelve. Row LLM zero eight, hidden context exposure. Applies: yes. How it manifests: the system prompt and tool definitions. Controls: no secrets in prompts, a canary string. Test: a canary check in the direct-injection suite. Row LLM zero nine, vector and embedding weaknesses. Applies: yes. Here I stop, because the controls column is empty. Our index is shared by all business units, and filtering happens after retrieval. That is a real gap, so I create a ticket with an owner. Row ASI zero six, memory and context poisoning. Our agent has no long-term memory, so I write not applicable, with the reason. Every row now has either controls and tests, a ticket, or a written reason.

7:52 Recap

Recap. Know the twenty twenty-five list and the August twenty twenty-six re-ranking, including hidden context exposure and the rise of excessive agency. Add the Agentic Top 10 for agents. Always cite edition years, and turn the lists into a coverage matrix with controls, tests and owners. Your next step: copy the matrix template from the lesson and fill it in for one of your systems.