The OWASP Top 10 for LLM Applications 2026 was published in August 2026. It is a widely used list of security risks for applications built on large language models, and its official release includes mappings to other frameworks, including the NIST AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1) and the NIST Generative AI Profile (NIST AI 600-1).

This post summarizes the 2026 list and shows how each risk lines up with the NIST AI RMF, using the mapping published with the OWASP release. The aim is practical: give security and governance teams one shared vocabulary.

The 2026 list

1. LLM01:2026 Prompt Injection. Inputs that change the model's behavior in unintended ways. The 2026 entry now also covers cross-modal attacks, such as instructions hidden in images or audio.
2. LLM02:2026 Sensitive Information Disclosure. Leakage of personal, confidential or proprietary data through model outputs.
3. LLM03:2026 Excessive Agency. Agents and tools given more functionality, permissions or autonomy than the task needs. It rose to third place in 2026.
4. LLM04:2026 Supply Chain. Risks in third-party models, datasets, libraries and services.
5. LLM05:2026 Data and Model Poisoning. Manipulated training, fine-tuning or embedding data that introduces vulnerabilities or backdoors.
6. LLM06:2026 Unbounded Consumption. Uncontrolled resource and cost use, from denial of service to runaway spend.
7. LLM07:2026 Misinformation. False or misleading output that people or systems act on.
8. LLM08:2026 Hidden Context Exposure. Extraction of system prompts, developer instructions, tool schemas and other hidden context. It replaces the 2025 entry System Prompt Leakage with a broader scope.
9. LLM09:2026 Vector and Embedding Weaknesses. Weaknesses in how embeddings are generated, stored and retrieved, including in RAG systems.
10. LLM10:2026 Improper Output Handling. Passing model output to downstream systems without validation. It now also covers insecure code generated by assistants.

The NIST AI RMF in one paragraph

The NIST AI RMF organizes AI risk work into four functions. Govern sets policy, roles and accountability. Map establishes context and identifies risks. Measure analyzes, assesses and tracks them. Manage prioritizes and acts on them. Each function is broken into categories, such as MEASURE 2 (evaluating trustworthiness) or GOVERN 6 (third-party policy).

How the risks map

The OWASP 2026 appendix maps each risk to the NIST AI RMF categories it most directly exercises. A short version:

• Prompt Injection: MEASURE 1 and MEASURE 2 (adaptive red-teaming and metrics), MAP 4 (mapping injection paths across components such as RAG corpora and tool servers).
• Sensitive Information Disclosure: MAP 5 (impact on people), MEASURE 2 (disclosure testing), MANAGE 4 (incident response and recovery).
• Excessive Agency: MANAGE 4 (monitoring agent actions, with circuit breakers and escalation to human review).
• Supply Chain: GOVERN 6, MAP 4 and MANAGE 3 as primary fits (supplier vetting, component inventories, third-party risk), with MEASURE 2 and MEASURE 3 in support.
• Data and Model Poisoning: MEASURE 3 (drift monitoring), MEASURE 2 (trigger and backdoor testing), GOVERN 6 (data and model lineage).
• Unbounded Consumption: MANAGE 1 (rate limits, spending caps, graceful degradation), MEASURE 2.
• Misinformation: MEASURE 2 as the primary fit (groundedness and consistency checks), with MEASURE 1, MEASURE 3 and MANAGE 1 in support.
• Hidden Context Exposure: MEASURE 2 (red-teaming for prompt and context extraction).
• Vector and Embedding Weaknesses: MAP 4 (the embedding layer as part of the trust boundary), MAP 5, MANAGE 4.

The OWASP appendix's NIST AI RMF table does not include a row for Improper Output Handling. In practice we treat it as an application security control and test it alongside the rest of the application.

How we use this

When we assess an AI application, we test against the OWASP list and report each finding with its NIST AI RMF category. Security teams get concrete technical findings. Governance teams get the same findings in the framework they already report against. Nobody has to translate.

Sources: the OWASP GenAI LLM Top 10 2026 and its canonical source repository, including Appendix A, Related Framework Mappings.

If you want this mapping applied to your own AI applications, reach out through our contact form or at info@menagos.com.