The 2026 LLM Top 10 lands: prompt injection still first, hidden context now its own line item

The mapping is the part that changes conversations with assessors. OWASP put the ten categories against nine external frameworks and taxonomies, MITRE ATLAS and ATT&CK included, explicitly so organisations can fold LLM risk into existing risk-management programmes ^[15]. That removes the escape hatch of arguing that AI systems sit outside the control framework. A questionnaire can now ask for evidence category by category, in vocabulary the GRC team already owns.

Two categories will produce the most awkward findings. Hidden context exposure covers system prompts, developer instructions, tool schemas and policy information handed to a model but never meant for users ^[9]. OWASP's advice here is unusually prescriptive: assume it will be discovered, keep credentials, tokens and other secrets out of it, and do not let it be the only control enforcing authorization or policy ^[10]. That is testable in an afternoon. Someone opens the prompt, looks for a token, then looks for the sentence that is doing the access control on its own.

The second is the retrieval layer. Weaknesses in the vectors and embeddings behind RAG, agent memory and semantic search let an attacker poison retrieval results, pull information out, or exploit data that was never properly separated ^[11]. OWASP's multi-tenant example is the one to sit with: an attacker may infer things about another customer's documents even where authentication controls are in place ^[13]. A failure that survives a correct authentication check is a failure your existing evidence does not speak to.

Supply chain has widened in the same direction. OWASP describes LLM supply chains as reaching past conventional software dependencies into third-party models, training data, adapters and model artifacts, any of which can be poisoned, tampered with or swapped for a malicious replacement, with breaches, biased output or outright failure as the result ^[3]. The companion explainer frames each of those as a trust boundary the organisation never reviewed but which still shapes production behaviour ^[4]. Dependency inventories built for packages do not enumerate a fine-tuning dataset or an adapter.

None of this closes with a filter. Prompt injection is not a parsing bug; it works because the model cannot separate instruction from data when both arrive as natural language, which makes sanitisation rules borrowed from structured query injection structurally insufficient ^[18]. So the compensating controls have to live elsewhere, which is why excessive agency matters more than its old position suggested: too much functionality, permission or autonomy, at exactly the moment agents are being wired into external tools, systems and data ^[2].

Then the bookkeeping problem. In the earlier breakdown still circulating in AppSec material, excessive agency is LLM08, sensitive information disclosure is LLM06, and insecure output handling is LLM02 ^[19]. In the 2026 ordering, excessive agency is third and sensitive information disclosure second ^[1], a jump of five and four places respectively ^[8][12]. Any runbook, exception register or contract clause that cites an LLM number rather than a category name is now pointing somewhere else.

Worth noting what the source actually ranks: the top three are ordered, and the other seven categories, among them unbounded consumption, misinformation and improper output handling, are listed without stated positions ^[6]. Ten in total ^[21]. Also worth noting how OWASP expects these to surface: poisoning that skews recommendations and business decisions, misinformation that feeds operational disruption and bad human calls ^[14]. Neither arrives as an alert.