Frequently asked questions about OWASP Top 10 for LLM Applications

Use this FAQ when you select OWASP security measures or work with the Modulos Framework.

Disclaimer

This page gives general information. It is not legal advice.

What is the OWASP Top 10 for LLM Applications?

The OWASP Top 10 for LLM Applications identifies ten security risks for LLM applications. The OWASP GenAI Security Project identifies it as a "community-developed awareness document" for "developers, architects, data scientists, security practitioners, and organizations building or operating applications that use large language models". For each risk, OWASP gives a "Description", examples, "Prevention and Mitigation Strategies", and attack examples. The OWASP Top 10 for LLM Applications recommends measures. It does not give obligations, and it is not law. See Use of the OWASP Top 10.

Is the OWASP Top 10 for LLM Applications mandatory?

No, the OWASP Top 10 for LLM Applications is not law and it does not give obligations in law. OWASP recommends security measures, and you select the measures that you use. A different law can apply to you or to your AI System and give you obligations. The OWASP Top 10 for LLM Applications does not tell you if a law applies. For that, see the Modulos information about that law, for example EU AI Act or GDPR. See Use of the OWASP Top 10.

What is the latest OWASP Top 10 for LLM Applications?

OWASP identifies the Top 10 for LLM Applications 2026 as the "Current release". OWASP released it on August 4, 2026, with the entries LLM01:2026 to LLM10:2026. OWASP identifies the 2025 Top 10 as an "archived release". OWASP released the 2025 Top 10 ("Version 2025") on November 18, 2024, with the entries LLM01:2025 to LLM10:2025. See Changes in 2025 and 2026.

MFF-11 in Modulos maps the 2025 Top 10. See Which OWASP LLM Top 10 version does Modulos use?.

Which OWASP LLM Top 10 version does Modulos use?

The Modulos Framework MFF-11 maps the OWASP Top 10 for LLM Applications 2025. MFF-11 is an AI System Framework. You add it to an AI System, and Modulos has no Organization Framework for it.

Most 2026 entries have different numbers, for example Excessive Agency is LLM06:2025 and LLM03:2026. The Requirements keep the 2025 numbers. A 2026 change does not show if a Requirement includes that change. For that, examine the Requirement in Modulos. See The Requirements and the OWASP risks.

What changed in the OWASP LLM Top 10 from 2025 to 2026?

OWASP changed the risk sequence in the Top 10 for LLM Applications 2026. OWASP expanded System Prompt Leakage and gave it the new name Hidden Context Exposure. LLM08:2026 Hidden Context Exposure is "the unauthorized extraction, inference, or reconstruction of hidden, non-user-facing system instructions or operational context placed in a model's context".

The project leads expanded four entries:

• Prompt Injection: "cross-modal attacks".
• Supply Chain: "the trust failure when a promoted model artifact is not what it claims to be".
• Data and Model Poisoning: "fine-tuning subversion".
• Improper Output Handling: "the insecure code that assistants generate at scale".

The 2025 Top 10 also includes "Multimodal Injection" and "Unsafe Code Generation". Entries with the same name can include different risks. See Changes in 2025 and 2026.

What changed between the OWASP LLM Top 10 2023 and 2025?

In the Top 10 for LLM Applications 2025, OWASP writes that Unbounded Consumption "expands on what was previously Denial of Service". The entry includes risks about "resource management and unexpected costs".

The 2025 Top 10 also added System Prompt Leakage. Its Vector and Embedding Weaknesses entry gives security measures for Retrieval-Augmented Generation (RAG) and "other embedding-based methods". OWASP expanded Excessive Agency because of "the increased use of agentic architectures". OWASP released the 2025 Top 10 on November 18, 2024. See Changes in 2025 and 2026.

Does RAG prevent prompt injection?

No. In the Top 10 for LLM Applications 2025, OWASP tells you that RAG and fine-tuning "do not fully mitigate prompt injection vulnerabilities". It also tells you that "it is unclear if there are fool-proof methods of prevention for prompt injection".

Prompt injection can occur without an attack. Direct prompt injection and indirect prompt injection "can be either intentional or unintentional". The model can read input that a person cannot see, for example by "hiding instructions in images that accompany benign text". OWASP recommends measures that "can mitigate the impact of prompt injections", for example "least privilege access", checks that "validate expected output formats", "human approval for high-risk actions", and "adversarial testing". See LLM01:2025 Prompt Injection.

Do system prompts prevent sensitive information disclosure?

Not fully. In the 2025 Top 10, OWASP writes that limits in the system prompt on output data "can provide mitigation against sensitive information disclosure". These limits "may not always be honored and could be bypassed via prompt injection or other methods". Users can accidentally give sensitive data, which "may later be disclosed in the model's output".

OWASP tells developers that "the system prompt should not be considered a secret, nor should it be used as a security control". OWASP recommends that developers keep credentials and other sensitive data out of the system prompt. OWASP also recommends authorization checks in systems that are external to the LLM. See LLM02:2025 Sensitive Information Disclosure and LLM07:2025 System Prompt Leakage.

Does monitoring prevent excessive agency?

No. In the Top 10 for LLM Applications 2025, OWASP gives measures to prevent Excessive Agency and measures to limit damage. Logging, monitoring, and rate limiting "will not prevent Excessive Agency, but can limit the level of damage caused". OWASP gives other measures that "can prevent Excessive Agency", for example:

• Give LLM agents only the necessary extensions, functions, and permissions.
• "Execute extensions in user's context".
• Get the approval of a person before "high-impact actions".
• Do authorization in downstream systems "rather than relying on an LLM to decide if an action is allowed or not".

See LLM06:2025 Excessive Agency.

Does the LLM Top 10 cover autonomous agents?

Yes, for some risks. In the OWASP Top 10 for LLM Applications 2025, LLM06:2025 Excessive Agency includes agents that select and use tools.

In the 2026 "Letter from the Project Leads", OWASP writes: "This list owns the risk when the model is a component inside your application." When the model becomes "an actor, with tools it can call, memory it carries between sessions, and consequences it sets in motion downstream", the risk moves to the Agentic Top 10. OWASP recommends the two Top 10s together for a model that starts "acting on its own". See Use of the OWASP Top 10 and OWASP Top 10 for Agentic Applications.

How does the OWASP LLM Top 10 map to NIST AI RMF?

OWASP maps its 2026 LLM Top 10 entries to NIST AI RMF Categories in Appendix A. The mapping uses NIST AI RMF (AI 100-1) v1.0 (2023). OWASP gives no NIST AI RMF mapping for LLM10:2026 Improper Output Handling. The NIST AI RMF mapping is at Category level, not at Subcategory level. OWASP also maps each 2026 entry to the "risk categories" of NIST AI 600-1, the Generative AI Profile.

The OWASP mapping is for the 2026 entries, not for the 2025 entries that the Modulos Framework uses. NIST gives this information: "The AI RMF 1.0 is being revised as part of the White House AI Action Plan". See Other Frameworks.

Does using the OWASP LLM Top 10 satisfy the EU AI Act?

No. OWASP identifies the Top 10 for LLM Applications as a "community-developed awareness document". It is not a decision about compliance with the EU AI Act. It does not tell you if the EU AI Act applies to you or to your AI System. It also does not tell you which EU AI Act obligations apply.

In the OWASP Top 10 for LLM Applications 2026, Appendix A has no EU AI Act mapping. The OWASP GenAI Security Crosswalk is different from the Top 10. Its README includes the EU AI Act mapping, LLM_EUAIAct.md, in "All mapping files". For the EU AI Act obligations, see EU AI Act and Other Frameworks.

Does Modulos run OWASP security tests when I add the Framework?

No. When you add the OWASP Framework MFF-11 to an AI System, you get its Requirements and the Controls that map to them. The Framework does not configure tests or schedules. You configure the tests that are available in Modulos, and their schedules, when they are necessary. In Modulos, Evidence and tests connect to Controls, and the Controls map to the Requirements. See Do the work.

When is an OWASP Requirement fulfilled in Modulos?

An OWASP Requirement becomes Fulfilled when its Requirement Owner changes its status to Fulfilled. First, all Controls that connect to the Requirement have a final status. The Requirement is then ready for review. Its Requirement Owner examines the completed Controls before the change to Fulfilled.

This condition, Evidence, and test results do not make the Requirement Fulfilled automatically. See Review the Requirements.