OWASP's Top 10 for LLM Applications (2026) treats the model as a component inside an application: the risks of its prompts, its outputs, its training data, and its supply chain. Its companion, the Top 10 for Agentic Applications , treats the model as an actor. Teams running coding agents live on the boundary between the two.

This walkthrough covers LLM01 to LLM10 with an example apiece. The 2026 edition reshuffled the list, most notably pushing Excessive Agency from 6th to 3rd and Unbounded Consumption from 10th to 6th, both reflecting the shift toward tool-using agents. As with the agentic list, each item ends with a short note on where an action-governance layer like AgentTrail helps, where it only adds visibility, and where the work is inference-level and, for us, planned.

LLM01:2026 · Prompt Injection

Untrusted input, whether direct or hidden in a document, web page, image, or audio the model ingests, overrides the model's instructions.…