Updated for 2026

OWASP Top 10 for LLM, Agentic AI and MCP

Three OWASP lists now describe how AI applications fail. The LLM Top 10 covers what a model can be made to say or reveal. The Agentic Top 10 covers what happens once it can act, and the MCP Top 10 covers the protocol that connects it to tools. This guide explains all 30 risks and links each one to the AI Goat labs where you can exploit it and test the defenses.

2026 OWASP Top 10 for LLM Applications LLM01–LLM10 · 23 AI Goat labs 2026 OWASP Top 10 for Agentic Applications ASI01–ASI10 · 12 AI Goat labs 2025 · beta OWASP MCP Top 10 MCP01–MCP10 · 11 AI Goat labs

46 hands-on labs across 29 of the 30 risks. MCP05 is documented but deliberately has no lab.

OWASP Top 10 for LLM Applications (2026)

Official LLM Top 10 on owasp.org

The most critical risks in applications built on large language models: what users and documents can make a model say, reveal or do. The 2026 edition (published 4 August 2026) keeps the same ten areas as 2025 but reorders them using real incident data, and broadens System Prompt Leakage into Hidden Context Exposure.

What changed from the 2025 list
2026	2025	Change
LLM01 Prompt Injection	LLM01 Prompt Injection	Still #1
LLM02 Sensitive Information Disclosure	LLM02 Sensitive Information Disclosure	Still #2
LLM03 Excessive Agency	LLM06 Excessive Agency	Up from #6
LLM04 Supply Chain	LLM03 Supply Chain	Down from #3
LLM05 Data and Model Poisoning	LLM04 Data and Model Poisoning	Down from #4
LLM06 Unbounded Consumption	LLM10 Unbounded Consumption	Up from #10
LLM07 Misinformation	LLM09 Misinformation	Up from #9
LLM08 Hidden Context Exposure	LLM07 System Prompt Leakage	Renamed and broadened
LLM09 Vector and Embedding Weaknesses	LLM08 Vector and Embedding Weaknesses	Down from #8
LLM10 Improper Output Handling	LLM05 Improper Output Handling	Down from #5

LLM01

Prompt Injection

Crafted input overrides the model's instructions. Direct injection comes from the user; indirect injection hides in documents, web pages, tickets or tool results the model reads.

Impact: Bypassed guardrails, leaked data, unauthorized actions and harmful output.
Practise it in AI Goat: Make Cracky, the shop chatbot, ignore its rules, then hide instructions in retrieved documents and assemble one across several documents.

llm01-1 Prompt Injection Basics Beginner
llm01-2 Indirect Injection Beginner
llm01-3 Chained Injection Intermediate
llm01-4 Indirect Injection via Retrieved Document Intermediate
llm01-5 Cross-Document Instruction Assembly Advanced

LLM02

Sensitive Information Disclosure

The model reveals confidential data from its context, training data or connected sources: PII, credentials, API keys or internal business details.

Impact: Exposed customer data and secrets that enable further attacks.
Practise it in AI Goat: Extract customer data through chat, probe for memorized training data, poison the knowledge base to manipulate answers, and retrieve documents you should not have access to.

llm02-1 Data Leakage Beginner
llm02-2 Training Data Extraction Intermediate
llm02-3 Context Poisoning Intermediate
llm02-4 Unauthorized Retrieval Intermediate

LLM03

Excessive Agency

LLM06:2025

A model is given more tools, permissions or autonomy than its task needs, so a manipulated model can take harmful actions on a user's behalf.

Impact: Unauthorized refunds, data changes, API calls and privilege escalation.
Practise it in AI Goat: Steer a tool-calling shop agent into issuing a refund, slip past a tool allowlist, and exploit a chatbot that confirms unauthorized actions without verification.

llm03-1 Excessive Agency via Tools Intermediate
llm03-2 Tool Allowlist Bypass Intermediate
llm03-3 Overpowered Assistant Intermediate

LLM04

Supply Chain

LLM03:2025

Compromised models, model files, datasets, plugins or third-party components introduce hidden behavior into an LLM application.

Impact: Silent backdoors that survive every prompt-level defense.
Practise it in AI Goat: Discover hidden backdoor triggers in a community-contributed Ollama Modelfile.

llm04-1 Modelfile Backdoor Intermediate

LLM05

Data and Model Poisoning

LLM04:2025

Training, fine-tuning or knowledge data is manipulated to introduce bias, backdoors or false facts into what the model produces.

Impact: Corrupted answers and attacker-controlled responses for chosen inputs.
Practise it in AI Goat: Plant a false catalog fact that the chatbot later cites as learned shop knowledge.

llm05-1 Data and Model Poisoning Beginner

LLM06

Unbounded Consumption

LLM10:2025

No limits on input size, request rate, tokens or compute let attackers exhaust resources or run up costs.

Impact: Denial of service, runaway inference costs and degraded service for every user.
Practise it in AI Goat: Push the chatbot into excessive, verbose output and see which limits kick in at each defense level.

llm06-1 Token Flood Intermediate

LLM07

Misinformation

LLM09:2025

The model produces false or fabricated information that sounds authoritative, and people or systems act on it.

Impact: Wrong decisions, reputational damage and legal exposure.
Practise it in AI Goat: Induce the shop assistant to produce confident but fabricated information.

llm07-1 Misinformation Intermediate

LLM08

Hidden Context Exposure

LLM07:2025 (System Prompt Leakage)

Anything placed in a model's hidden context, such as system prompts, tool schemas or retrieved snippets, can surface in its answers and be reused to plan sharper attacks.

Impact: Leaked instructions, policies and internal details that defeat the remaining controls.
Practise it in AI Goat: Extract Cracky's system prompt and see what each defense level keeps out of context.

llm08-1 System Prompt Extraction Beginner

LLM09

Vector and Embedding Weaknesses

LLM08:2025

Weaknesses in RAG pipelines, vector stores and embeddings let attackers inject content into retrieval or reach documents they should not see.

Impact: Poisoned knowledge bases, manipulated search results and cross-tenant leaks.
Practise it in AI Goat: Poison the ChromaDB knowledge base, stuff keywords to win retrieval, spoof a trust tier, flood the context and serve stale knowledge.

llm09-1 Vector and Embedding Weaknesses Beginner
llm09-2 Retrieval Keyword Stuffing Intermediate
llm09-3 Trust-Tier Spoofing Beginner
llm09-4 Context Flooding Intermediate
llm09-5 Stale Knowledge Beginner

LLM10

Improper Output Handling

LLM05:2025

Model output is passed to browsers, shells, databases or other components without validation or encoding.

Impact: Cross-site scripting, SSRF and code execution through AI-generated content.
Practise it in AI Goat: Exploit unescaped chatbot output to inject HTML and JavaScript (XSS) into the shop.

llm10-1 Improper Output Handling Beginner

OWASP Top 10 for Agentic Applications (2026)

Official Agentic Top 10 on owasp.org

Risks that appear once a model can plan, call tools, keep memory and work with other agents. The ASI codes describe what goes wrong when an AI system acts, not only when it talks.

ASI01

Agent Goal Hijack

A crafted input replaces the agent's objective, so its later tool use serves the attacker instead of the user.

Impact: Every downstream action is redirected, not just one reply.
Practise it in AI Goat: A planted support ticket rewrites the admin assistant's goal. Labs score the action it takes.

asi01-1 Planted Ticket Rewrites the Goal Intermediate

ASI02

Tool Misuse and Exploitation

An agent is steered into calling legitimate tools with attacker-chosen arguments.

Impact: Real actions such as discounts, refunds or exports, through tools the product meant to expose.
Practise it in AI Goat: Get the shop agent to apply a staff-only coupon, then compare an allowlist and the Intent Gate.

asi02-1 Tool Misuse Intermediate

ASI03

Identity and Privilege Abuse

Delegated credentials, session tokens or over-broad tool scopes let an agent act as the wrong principal.

Impact: One user's request reads or changes another user's data.
Practise it in AI Goat: Make the agent export another customer's data through a weakly scoped tool.

asi03-1 Export Another Customer Intermediate

ASI04

Agentic Supply Chain Vulnerabilities

Poisoned tool descriptors, typosquatted servers and untrusted skill packs enter an agent the same way a malicious dependency enters an app.

Impact: A hostile catalogue compromises the agent without any jailbreak.
Practise it in AI Goat: The admin assistant loads a shadow catalog and reads a hostile tool description. Spot it before it steers the agent.

asi04-1 Hostile Catalogue Intermediate

ASI05

Unexpected Code Execution (RCE)

Planner output treated as code reaches an execution sink the product never meant to expose.

Impact: Command execution on whatever host runs the agent.
Practise it in AI Goat: Reach a shell executor that runs inside a disposable Docker container with no network and a read-only root filesystem. Nothing runs on your host.

asi05-1 Sandboxed Shell Executor Beginner

ASI06

Memory & Context Poisoning

Persisted notes and retrieved snippets become the next session's trusted history, so one planted entry steers later runs.

Impact: Long-lived compromise that survives the conversation that caused it.
Practise it in AI Goat: Plant a standing note that approves refunds, see the Level 2 memory scan drop it, and run the full Agentic Kill Chain capstone.

asi06-1 Memory Poisoning Intermediate
asi06-2 Memory Scan at Level 2 Beginner
killchain-1 Agentic Kill Chain: The Compromised eCommerce Agent Advanced

ASI07

Insecure Inter-Agent Communication

Messages between agents without origin checks, signatures or nonces can be replayed, spoofed or rewritten.

Impact: One agent trusts instructions that never came from its peer.
Practise it in AI Goat: Exploit an unsigned agent handoff, using a deterministic, scripted peer.

asi07-1 Unsigned Handoff Intermediate

ASI08

Cascading Failures

One bad tool result fans out through a planner into many downstream calls before anyone notices.

Impact: A single fault grows into a system-wide incident.
Practise it in AI Goat: Watch the blast radius of a scripted fan-out grow, then trip the circuit breaker.

asi08-1 Fan-out and Circuit Breaker Advanced

ASI09

Human-Agent Trust Exploitation

A persuasive rationale gets a human to approve an action they would reject if they read the raw request.

Impact: Human-in-the-loop controls approve the attack.
Practise it in AI Goat: Read a plausible summary next to the actual tool arguments in an approval dialog, and catch the mismatch.

asi09-1 Human-Agent Trust Exploitation Beginner

ASI10

Rogue Agents

After a successful injection, a persisted goal keeps acting after the original conversation is over.

Impact: Leftover agency that keeps doing the attacker's work.
Practise it in AI Goat: Follow a stored post-injection note into the next run, then contain it with a halt.

asi10-1 Rogue Note on the Next Run Advanced

OWASP MCP Top 10 (2025)

Official MCP Top 10 on owasp.org

Risks in the Model Context Protocol, the standard that connects AI applications to tools and data through MCP servers. The list is still in beta, so codes and titles may change.

Beta list: risk codes and titles may change in future editions.

MCP01

Token Mismanagement & Secret Exposure

Tokens and secrets carried in MCP traffic or tool results leak into logs, transcripts and model context.

Impact: Credentials end up in places attackers and models can read.
Practise it in AI Goat: Spot a decoy billing key that a support tool returns into the assistant's context.

mcp01-1 Token Mismanagement & Secret Exposure Beginner

MCP02

Privilege Escalation via Scope Creep

A server grows new tools, or a client never checks scope, so the integration acts far beyond its original approval.

Impact: Capabilities nobody approved are used anyway.
Practise it in AI Goat: Watch a server update add an export tool the original approval never covered, and see whether it runs.

mcp02-1 Scope Creep / Capability Discovery vs Authorization Beginner

MCP03

Tool Poisoning

Hostile text in a tool's name, description or schema is read by the model as instructions.

Impact: The assistant calls tools the user never asked for.
Practise it in AI Goat: Three labs: a poisoned tool description, a rug-pull redefinition after approval, and schema drift that adds a dangerous argument.

mcp03-1 Tool Description Poisoning Beginner
mcp03-2 Tool Redefinition (Rug-Pull) Intermediate
mcp03-3 Tool Schema Drift Intermediate

MCP04

Software Supply Chain Attacks & Dependency Tampering

A typosquatted or substituted MCP server impersonates a trusted tool host.

Impact: The client runs an attacker's server under a trusted name.
Practise it in AI Goat: A community package copies the official tool name and description, and the host merges tools by name.

mcp04-1 Lookalike Integration Intermediate

MCP05

Command Injection & Execution

Tool arguments reach a shell or eval sink inside an MCP server.

Impact: Remote code execution on the server host.
Practise it in AI Goat: Deliberately not built as an MCP lab, so the playground never exposes a host command sink. Practise code execution safely in ASI05 instead.

MCP06

Intent Flow Subversion

Payloads hidden in resources or tool text divert the client's next planned call.

Impact: The assistant's plan quietly changes to serve the attacker.
Practise it in AI Goat: A shopper's poisoned ticket leads the admin assistant to call issue_refund.

mcp06-1 Poisoned Ticket Flips the Next Call Intermediate

MCP07

Insufficient Authentication & Authorization

The client never authenticates the server or the user, or forwards credentials to the wrong server.

Impact: Any tool is available to whoever can speak the protocol.
Practise it in AI Goat: Follow a staff credential that is passed through to a server that should never see it.

mcp07-1 Token Passthrough Intermediate

MCP08

Lack of Audit and Telemetry

Without a JSON-RPC transcript, nobody can say which tool ran, with what arguments, or why.

Impact: Rug pulls and secret leaks become impossible to investigate.
Practise it in AI Goat: A blue-team exercise: reconstruct a recorded MCP session from its transcript.

mcp08-1 Reconstruct the Session Beginner

MCP09

Shadow MCP Servers

A server the user never chose is spawned, or claims an identity it does not have.

Impact: Unvetted code runs inside the trusted toolchain.
Practise it in AI Goat: A server claims to be the official catalog, but a different implementation was launched. Catch it.

mcp09-1 Unverified Server Identity Intermediate

MCP10

Context Injection & Over-Sharing

Resources and results are dumped wholesale into the model's context, including attacker-controlled text.

Impact: The model sees, and may leak or act on, far more than the task needs.
Practise it in AI Goat: Support tickets dumped into context lead to an over-shared customer export.

mcp10-1 Tickets Dumped into Context Intermediate

How the three lists fit together

One attack, three codes. A poisoned MCP tool description is MCP03 Tool Poisoning. It works because of LLM01 Prompt Injection, and if the agent acts on it, it becomes ASI01 Agent Goal Hijack.

Memory changes the timeline. LLM01 ends with the conversation. ASI06 Memory & Context Poisoning and ASI10 Rogue Agents describe the same injection surviving into later runs.

Defend in layers. Input and output controls address the LLM list. Tool allowlists, approvals and memory scans address agents, and tool, schema and origin pinning address MCP.

See this play out end to end in the Agentic Kill Chain capstone, or read the AI Goat v2.0 announcement.

Frequently asked questions

What changed in the OWASP Top 10 for LLM Applications 2026?

The 2026 edition keeps the same ten risk areas as 2025 but reorders them, weighting real incident data alongside a practitioner vote. Excessive Agency rises from LLM06 to LLM03, Unbounded Consumption from LLM10 to LLM06 and Misinformation from LLM09 to LLM07, while System Prompt Leakage (LLM07:2025) is broadened and renamed Hidden Context Exposure (LLM08:2026). Prompt Injection stays LLM01 and Sensitive Information Disclosure stays LLM02.

What is the OWASP Top 10 for Agentic Applications?

It is the OWASP GenAI Security Project list of the ten most critical risks in AI agents: systems where a model plans, calls tools, keeps memory and works with other agents. Its codes run from ASI01 Agent Goal Hijack to ASI10 Rogue Agents, and include tool misuse, identity and privilege abuse, memory and context poisoning, insecure inter-agent communication and human-agent trust exploitation.

What is the OWASP MCP Top 10?

The OWASP MCP Top 10 lists the most important security risks in the Model Context Protocol (MCP), which connects AI applications to tools and data through MCP servers. It covers token and secret exposure, scope creep, tool poisoning, supply chain attacks, command injection, intent flow subversion, weak authentication, missing audit trails, shadow MCP servers and context over-sharing. It is currently a beta list.

Which OWASP list should I use for my AI application?

Use the LLM Top 10 for any application that sends user or document content to a language model. Add the Agentic Top 10 when the model can call tools, keep memory or act on its own, and the MCP Top 10 when it connects to tools through MCP servers. Most production AI apps now need all three, because a single attack, such as a poisoned document, often crosses all of them.

How can I practise the OWASP LLM, Agentic and MCP Top 10 hands-on?

AI Goat is a free, open source AI security playground with 46 labs mapped to these lists: 23 for the LLM Top 10, 12 for the Agentic Top 10 and 11 for the MCP Top 10. You run it locally, exploit each risk, then replay the attack at three defense levels to see which controls stop it.

Explore the attack labs