The OWASP Top 10, the canonical list of web application security risks, has been a foundational reference for 20 years. The 2021 edition added four new categories, including “insecure design” and “software and data integrity failures.” The 2025 edition is overdue. The categories, even as of the 2021 update, do not adequately cover the threats that have emerged in the last 5 years: prompt injection, agent autonomy, training data poisoning, model theft, supply chain attacks on ML pipelines, vector store exfiltration, agent identity and authorisation. The OWASP Top 10 is, in 2026, behind the threat. The fix is not a new OWASP Top 10. The fix counts as the use of the OWASP AI Exchange and the OWASP Top 10 for LLM Applications, which are the right lists for the current threat, even if they have not yet achieved the same adoption as the original Top 10.
The OWASP Top 10 is, in 2026, a victim of its own success. The Top 10 was, in 2003, a clear list of the most important web application security risks. The Top 10 drove awareness, drove training, drove investment in security tooling. The Top 10 was, for 20 years, the right list. The Top 10 is, in 2026, the right list for the threats of 2003. The Top 10 is, in 2026, the wrong list for the threats of 2026.
The threats of 2026 include things the original Top 10 authors could not have imagined. The threats of 2026 involve AI systems, agentic systems, retrieval augmented generation, vector databases, prompt injection, training data exfiltration, model supply chain attacks. The threats of 2026 are not, in most cases, well described by the original Top 10. The threats of 2026 require a new list, or several new lists, or a new framework. The OWASP AI Exchange and the OWASP Top 10 for LLM Applications are the right lists. The adoption of the right lists is, however, behind the threat.
What the OWASP Top 10 is
The OWASP Top 10 is a list, published by the Open Web Application Security Project, of the ten most critical web application security risks. The list is compiled every few years, with input from security researchers, vendors, and practitioners. The list is, in most cases, the basis for security training, for security testing, for security tooling, for compliance frameworks. The list is, in many organisations, the first thing the developers read when they are learning about web application security. The list is, in many compliance regimes, the reference for the security requirements.
The list has been, for 20 years, a remarkably stable reference. The categories have evolved, with the addition of API security, with the addition of software and data integrity failures, with the addition of insecure design. The list has not, however, fundamentally changed in 20 years. The list is still, in 2026, mostly about traditional web application security. The list is still, in 2026, mostly about SQL injection, cross site scripting, broken access control, the categories that have been the top of the list for most of the 20 years.
Why it has been foundational
The list has been foundational because it has been a shared vocabulary. The list has given the security community a way to talk about web application security that did not exist before. The list has given the developers a way to think about web application security that they could learn in a workshop, that they could test for in a code review, that they could check for in a tool. The list has given the security industry a way to sell products, with the categories as the basis for the product features, with the categories as the basis for the marketing.
The list has also been foundational because it has been right. The categories in the list, even the categories that have been in the list for 20 years, are still the categories that lead to the most breaches. The list is not stale because the categories are wrong. The list is stale because the categories are not complete. The list does not cover the new threats. The list covers the old threats well.
What it covers well
The OWASP Top 10 covers the traditional web application security risks well. The categories, even in the 2021 update, are the categories that lead to the bulk of the web application breaches. Broken access control, the new number one in 2021, amounts to the category behind the majority of unauthorised access breaches. Cryptographic failures, identification and authentication failures, injection, insecure design, security misconfiguration, vulnerable and outdated components, software and data integrity failures, security logging and monitoring failures, server side request forgery. Each of these is real. Each of these is a real cause of real breaches. Each of these is, in 2026, a real risk that the developers need to defend against.
The list is, in other words, a list of the threats that have been the threats for the last 20 years. The list is not a list of the threats that have emerged in the last 5 years. The list is, in this sense, a foundation, but not a current reference.
What it does not cover
The OWASP Top 10, in 2026, does not cover the threats that have emerged in the last 5 years. The list does not cover prompt injection, the technique by which an attacker embeds instructions in untrusted content that the AI agent then follows. The list does not cover agent autonomy, the risk that the agent acts beyond the scope the user intended. The list does not cover training data poisoning, the risk that the model was trained on data that included attacker controlled content. The list does not cover model theft, the risk that the model’s weights are exfiltrated. The list does not cover supply chain attacks on the ML pipeline, the risk that the training data, the model weights, the inference code, the deployment infrastructure, is compromised at any point in the chain. The list does not cover vector store exfiltration, the risk that the agent’s memory, the embeddings, the retrieval data, is exfiltrated. The list does not cover agent identity and authorisation, the risk that the agent acts on behalf of the wrong user, with the wrong permissions, on the wrong resource.
Each of these is a real threat. Each of these is, in 2026, a threat that has led to real breaches. Each of these is, in the OWASP Top 10, not on the list. The list, in other words, is not a complete reference for the current threat landscape.
The LLM era threats
The LLM era threats are, in 2026, the dominant threats in the security of AI enabled applications. The threats include, in addition to the ones listed above, jailbreaks that bypass system prompts, model inversion that reconstructs training data from outputs, membership inference that determines whether a specific data point was in the training set, prompt extraction that recovers the system prompt, indirect prompt injection that hides instructions in tool results, and the long tail of attacks that are specific to the LLM architecture.
These threats are not, in most cases, well described by the categories in the OWASP Top 10. The threats are described, in the security community, by a different vocabulary. The vocabulary is, in many cases, the vocabulary of the AI security researchers, who have been working on the threats since the early 2020s, who have developed the categories, who have built the tools, who have been writing the reports.
The OWASP Top 10 for LLM Applications
The OWASP Top 10 for LLM Applications stands as the LLM era’s answer to the original OWASP Top 10. The list, published in 2023 and updated annually, covers the LLM era threats in the same way the original list covers the web application threats. The categories include prompt injection, insecure output handling, training data poisoning, model denial of service, supply chain vulnerabilities, sensitive information disclosure, insecure plugin design, excessive agency, overreliance, and model theft.
The list is, in 2026, the right list for AI enabled applications. The list has the same role, in the LLM era, that the original OWASP Top 10 had in the web application era. The list has, however, not yet achieved the same adoption. The list is, in most organisations, less well known. The list is, in most compliance regimes, not yet a reference. The list is, in most training programmes, not yet standard.
The OWASP AI Exchange
The OWASP AI Exchange becomes the broader framework that the Top 10 for LLM Applications sits within. The Exchange is a wiki, a community, a set of resources for AI security. The Exchange covers the threats, the mitigations, the tools, the training, the testing. The Exchange is, in 2026, the most comprehensive public reference for AI security.
The Exchange is also, in 2026, less well known than the original OWASP Top 10. The Exchange has, however, been growing fast. The Exchange is, by 2026, the de facto reference for the security teams that are doing the work on AI security. The Exchange becomes the place where the categories are defined, where the mitigations are documented, where the tools are listed, where the testing approaches are shared.
What to do about it
- Treat the OWASP Top 10 as the foundation, not the current reference. The original list is right for the traditional threats. The original list is not right for the current threats.
- Add the OWASP Top 10 for LLM Applications to the security reference set. The list covers the LLM era threats. The list is, in 2026, the right list for AI enabled applications.
- Add the OWASP AI Exchange to the training and reference set. The Exchange runs as the most comprehensive public reference for AI security.
- Map the existing security testing, the existing code review, the existing threat modelling, against both lists. The mapping will show where the existing testing covers the current threats and where it does not. The mapping will be the basis for the gap analysis.
- Update the training programmes to include the AI era threats. The training that only covers the original Top 10 is training for a threat landscape that no longer exists. The training that covers both lists is training for the current landscape.
- Update the compliance frameworks to reference both lists. The compliance frameworks that only reference the original Top 10 are compliance frameworks that do not cover the current threats. The compliance frameworks that reference both lists are the frameworks that are aligned with the current landscape.
- Watch for the next OWASP Top 10 update. The next update is expected to incorporate the AI era threats. The update will be, when it lands, the right list. Until the update lands, use both lists.
The honest assessment
The OWASP Top 10 is a victim of its own success. The list has been, for 20 years, the right list. The list is, in 2026, the right list for the 2010s. The list is, in 2026, the wrong list for the 2020s. The wrong list is not because the OWASP authors are wrong. The wrong list is because the threat landscape has changed faster than the OWASP process can update.
The OWASP Top 10 for LLM Applications and the OWASP AI Exchange are the right lists for the 2020s. The lists are, in 2026, the de facto references for the security teams that are doing the work. The lists are, however, not yet as widely adopted as the original Top 10. The adoption runs as the work. The work amounts to the gap. The gap is what the next 2 to 3 years will close.
The bottom line
The OWASP Top 10 is, in 2026, behind the threat. The list covers the 2010s threats well. The list does not cover the 2020s threats. The fix sits as the OWASP Top 10 for LLM Applications, the OWASP AI Exchange, and the discipline to use both lists until the next update lands. The fix is not to wait for the update. The fix is to use the lists that exist, today, and that are right, today, for the threats that exist, today. The work runs as the adoption. The adoption counts as the gap. The gap is what the work closes.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
