Cross-reference
OWASP Top 10 for LLM Applications 2026
10 items: 6 met directly by a control at Level 3, 4 partly, 0 deliberately out of scope.
To ask an AI assistant which controls cover an item, connect it to the MCP server.
Mapped by: drafted with AI assistance, 2026-11-13. Reviewed by: the author, 2026-11-13. Checked: 2026-11-13. Confidence: 4 high, 6 medium, 0 low.
| Ref | Item (our description) | Controls | Note | Confidence |
|---|---|---|---|---|
| LLM01:2026 | Prompt Injection; input from users, retrieved content, tools or memory that changes what the model does in ways the builder did not intend | SEC-02 direct, SEC-06 direct, TEC-04 partial, RSK-07 partial, MON-02 partial, SEC-01 partial, PPL-01 partial | Threat modelling covers AI specific threats (SEC-02), and for agents it names instructions hidden in content they read (SEC-02.6). Testing before release attempts to bypass generative AI safeguards (SEC-06.4) and to make agents act outside their permissions through hidden instructions (SEC-06.6). The source's main defence, limiting what a compromised model can do, is carried by least privilege on other systems (TEC-04.4) and approval for consequential agent actions (RSK-07.4); MON-02 logs agent actions. Input filtering, separating untrusted content and stripping hidden characters are engineering measures left to the security baseline (SEC-01). | medium direct rests partly on agentic and generative AI criteria; for a simple non-generative use the cover is lighter |
| LLM02:2026 | Sensitive Information Disclosure; personal, confidential or proprietary data exposed through model outputs, retrieval, logs or reasoning traces | SEC-04 direct, SEC-06 direct, MON-02 direct, DAT-07 partial, DAT-05 partial, RSK-09 partial, OPM-04 partial, SEC-05 partial | Rules on which information may be used with which tools, backed by technical measures (SEC-04), testing that personal or sensitive information is not disclosed (SEC-06.5) and monitoring outputs for it in live use (MON-02.7) carry it. Access limited to purpose (DAT-07.1) supports authorisation before retrieval; supplier due diligence and contract terms cover data sent to providers (RSK-09, OPM-04); SEC-05 covers the incident response. Scrubbing logs and traces and privacy preserving training are left to the security baseline. | high |
| LLM03:2026 | Excessive Agency; a model given more tools, functions, permissions or autonomy than its task needs, so a bad output becomes a harmful action | TEC-04 direct, RSK-07 direct, GOV-06 partial, MON-02 partial, SEC-02 partial, SEC-06 partial | TEC-04 limits the permissions and actions an AI system or agent holds on other systems to what its purpose needs, approved and risk assessed (TEC-04.4, TEC-04.5); RSK-07.4 requires a person's approval for consequential or hard to reverse agent actions. The inventory records what each agent can act on (GOV-06.6), MON-02.8 logs every agent action and lets a named person stop it, and SEC-02.6 and SEC-06.6 model and test misuse of tools. Running tools in the user's own security context and rate limiting tool use are not named. | high |
| LLM04:2026 | Supply Chain; compromised or vulnerable third party models, data sets, adapters, packages and platforms used to build or run an LLM application | SEC-03 direct, RSK-09 partial, OPM-04 partial, GOV-06 partial, DAT-08 partial, TEC-05 partial | SEC-03 assesses the security of every external model, data set and component before use, records its source, reassesses it and tracks disclosed vulnerabilities to mitigation. Supplier due diligence (RSK-09), contract terms (OPM-04), the inventory of components (GOV-06.4, GOV-06.5), data provenance (DAT-08) and version control (TEC-05) support it. A signed bill of materials and model signing are left to the security baseline. | high |
| LLM05:2026 | Data and Model Poisoning; training, tuning, retrieval or feedback data manipulated to plant bias, backdoors or false content in a model's behaviour | DAT-08 partial, SEC-03 partial, TEC-05 partial, TEC-06 partial, MON-02 partial, SEC-02 partial, SEC-06 partial, DAT-03 partial | Held at partial: provenance of training and test data (DAT-08), security assessment of external data sets and models (SEC-03), versioned data with rollback (TEC-05), testing (TEC-06, SEC-06), drift and unexpected behaviour monitoring (MON-02) and threat modelling (SEC-02) all contribute. No control requires content entering retrieval stores, memory or automated retraining to be validated before it is trusted, which is where the source puts much of the 2026 risk. Candidate for the agentic AI roadmap item. | medium a reviewer could see the training data side as direct through DAT-08 and SEC-03; partial rests on the retrieval and feedback side |
| LLM06:2026 | Unbounded Consumption; uncontrolled use of a model that runs up cost, exhausts capacity or lets an attacker copy the model through bulk queries | OPM-03 direct, OPM-09 partial, MON-02 partial, SEC-01 partial, SEC-02 partial | OPM-03 tracks and forecasts running costs and sets usage limits or cost alerts for every AI service (OPM-03.4), which is the source's hard spending cap. OPM-09 gives a fallback or safe stop when a service degrades, MON-02 monitors misuse, and threat modelling (SEC-02) can cover model extraction. Per user rate limits, input size limits and circuit breakers for agent loops are left to the security baseline (SEC-01). | medium cost is covered directly; availability attacks and model extraction rest on the baseline |
| LLM07:2026 | Misinformation; false or unsupported output that people or connected systems rely on, including tool calls made on wrong premises | TEC-06 direct, MON-02 partial, RSK-07 partial, GOV-10 partial, PPL-01 partial, OPM-09 partial, MON-04 partial | Accuracy testing against agreed criteria before release (TEC-06) and accuracy monitoring in live use (MON-02.1) identify it; human oversight (RSK-07, including approval for consequential agent actions), review of AI generated content before it informs decisions (GOV-10.2), literacy about limits (PPL-01), fallbacks for wrong output (OPM-09.2) and incident reporting (MON-04) manage it. Checking claims against authoritative sources at run time, before an agent acts on them, is not named. | high |
| LLM08:2026 | Hidden Context Exposure; system prompts, tool schemas and other hidden instructions extracted, and harm where they hold secrets or act as a security boundary | SEC-04 partial, TEC-05 partial, TEC-04 partial, SEC-02 partial, SEC-06 partial, SEC-01 partial | Held at partial: the source's two main measures, keeping secrets out of hidden context and enforcing authorisation outside the model, are engineering rules for the security baseline (SEC-01). Information rules (SEC-04), prompts under version control (TEC-05.1), least privilege on other systems (TEC-04.4), threat modelling (SEC-02) and disclosure testing (SEC-06.5) contribute. | medium partial set by the altitude rule; no specific control names hidden context |
| LLM09:2026 | Vector and Embedding Weaknesses; retrieval stores that leak data across users, accept poisoned content or reveal source text through embeddings | DAT-07 partial, SEC-04 partial, DAT-08 partial, SEC-02 partial, SEC-06 partial, MON-02 partial, DAT-06 partial | Held at partial: access limited to purpose and approved by the data owner (DAT-07) supports permission aware retrieval, and information rules (SEC-04), provenance (DAT-08), threat modelling (SEC-02), disclosure testing (SEC-06.5), monitoring (MON-02) and records management (DAT-06) contribute. No control names retrieval stores, separating content by trust level, or validating content before it is embedded. | medium retrieval stores are not named in any control |
| LLM10:2026 | Improper Output Handling; model output passed to browsers, databases, shells or other systems without validation, enabling injection and code execution | TEC-04 partial, SEC-01 partial, SEC-02 partial, SEC-06 partial, MON-02 partial | Held at partial: this is application security engineering (validation, encoding, parameterised queries, content security policy), which AACF leaves to the security baseline (SEC-01). Integrations through supported, documented interfaces (TEC-04), threat modelling (SEC-02), security testing (SEC-06) and output monitoring (MON-02) contribute. | medium partial set by the altitude rule |
References and short descriptions only; see the source publication for its own text. The cross-reference is the author's interpretation and is not endorsed by the publisher. See notices.