Score Your Business Against the OWASP LLM Top 10

On August 4, 2026, OWASP published its heaviest rewrite yet of the OWASP LLM Top 10 — the most widely referenced list of security risks in AI applications. Eight of the ten entries moved. This time, the rankings weren’t just a community vote: OWASP’s project leads weighted community judgment (75%) alongside a corpus of over 7,700 real-world incidents (25%) for the first time.

The list is written for developers and security engineers, but every business using AI tools — not just building them — is exposed to these same 10 risks. Here’s a plain-English scorecard so you can check your own AI stack against the current list, not last year’s.

The OWASP LLM Top 10 Self-Scorecard (2026 Edition)

Answer honestly about the AI tools your business actually uses today. Score 1 point for every “No.”

1. Prompt Injection (Direct & Indirect) — Could someone manipulate your AI tool’s behavior by typing specific prompts, or by hiding malicious instructions inside documents, emails, or web pages the AI reads? (We covered this in depth in our prompt injection risk guide.)
2. Sensitive Information Disclosure — Could your AI tool accidentally reveal confidential business or customer data in its responses, or was it trained on data it shouldn’t have had access to? (Related to what we covered in our ChatGPT business data privacy guide.)
3. Excessive Agency — Can your AI tool actually do things — send emails, make purchases, access files, browse the web, update records — rather than just generate text?
4. Supply Chain — Do you know whether the AI tool, plugin, or underlying model your business relies on comes from a vetted, maintained source — or could a compromised third-party component affect it?
5. Data and Model Poisoning — If your AI tool learns from data your business feeds it (support tickets, documents, feedback), could someone intentionally corrupt that data to change how it behaves?
6. Unbounded Consumption (Denial of Wallet) — Could a single user, automated script, or runaway process drain your API budget or overwhelm your AI tool due to missing rate limits or spending caps?
7. Misinformation — Does your business ever use AI-generated content in a customer-facing or decision-making context without independently verifying it’s accurate?
8. Hidden Context Exposure — Could a user trick your AI tool into revealing system instructions, memory logs, tool schemas, or background documents sitting inside its context window?
9. Vector and Embedding Weaknesses — If your business uses an AI tool with a custom knowledge base (a chatbot trained on your own documents), do you know who else’s data might be retrievable through it?
10. Improper Output Handling — Does your business ever take an AI tool’s output (code, a link, a formula, a command) and run or execute it without a human checking it first?

What Your Score Means

Score Range	Security Posture	Action Required
8 – 10 points	Strong posture	Maintain current controls; conduct quarterly access reviews
5 – 7 points	Moderate gap	Identify unverified integrations and apply strict permission bounds
0 – 4 points	Critical exposure	Immediately restrict autonomous actions and enforce human-in-the-loop validation

The Risk That Just Jumped Three Places: Excessive Agency

Most readers score themselves “safe” on question 3 without realizing they shouldn’t — and OWASP’s own 2026 data backs up why that matters. Excessive Agency climbed from 6th place to 3rd, the single biggest promotion on the entire list, because agentic AI went from a niche concept to something quietly embedded in mainstream tools during 2025 and 2026.

The mistake isn’t dishonesty — it’s that AI tools are gaining real-world capability faster than most businesses are tracking it. A browser-automation extension, an email-drafting assistant with a “send” button, an AI feature bolted onto your CRM that can update customer records — these are all forms of agency, and most of them arrived as a feature update to a tool you were already using, not a new product you consciously adopted.

This is precisely why OWASP calls it “Excessive Agency” rather than just “Agency” — the risk isn’t that an AI tool can act, it’s that it’s usually granted more permission than the specific task requires, “just in case,” and nobody audits it afterward. A support chatbot that only needs to look up order status sometimes ends up with permission to issue refunds, because that was the easiest way to set it up — not because anyone decided the chatbot should be trusted with your business’s money.

Unbounded Consumption and “Denial of Wallet” (Promoted to #6)

Excessive Agency wasn’t the only major mover. Unbounded Consumption jumped from 10th place to 6th, and OWASP’s updated description leans harder into what security researchers call a “Denial of Wallet” attack: rather than knocking a service offline, an attacker (or simply an unmonitored automated process) drives up API costs by triggering excessive token usage, oversized inputs, or reasoning loops that quietly rack up compute charges.

With modern models handling much larger context windows, an unmonitored integration can turn into a serious, fast-moving bill before anyone notices — this is now as much a finance risk as a security one.

Closing: A Practical 4-Step Remediation Plan

If your scorecard revealed gaps, here’s where to start:

1. Audit AI agency. Inventory every AI integration with action-taking permissions (sending emails, editing records, executing code) and restrict them using the principle of least privilege.
2. Enforce human-in-the-loop review. Require explicit approval from a team member before an AI tool executes any high-risk transaction or data change.
3. Cap API budgets. Set daily rate limits and automated spending alerts across every LLM API provider your business uses, to block Denial of Wallet exposure before it becomes a bill.
4. Map to broader frameworks. Use your score as a starting point to align with recognized frameworks like the NIST AI RMF, ISO/IEC 42001, or the EU AI Act’s requirements where relevant to your business.

Most of the OWASP LLM Top 10 isn’t a developer-only concern once your business is actually using AI tools day to day — it’s a list of questions worth an honest answer, checked against the current edition rather than an outdated one.

For the full technical detail behind each of these 10 risks, see OWASP’s official 2026 LLM Top 10.