OWASP LLM Top 10 (2026)
Every Inkog finding carries the OWASP GenAI LLM Top 10 2026 category id its rule declares (for example LLM10:2026) in compliance_mapping.owasp_items, and the OWASP Agentic Top 10 2026 id in compliance_mapping.owasp_agentic_threats (CLI JSON, REST API, MCP). The matrix below is generated from that same rule metadata, so it lists exactly what a scan can report. It is the single source for OWASP coverage claims on this site.
Read the Status column: a category counts as detected only when at least one rule stamps its id. Rules that also map to the classic OWASP Web Top 10 keep that id in owasp_web.
Coverage Matrix
OWASP GenAI LLM Top 10 2026. Generated from the rule engine’s metadata; do not edit by hand.
| Category | Status | Rules that stamp this id | Notes |
|---|---|---|---|
| LLM01: Prompt Injection | Active detection | prompt_injection, prompt_template, skill_tool_poisoning | Direct and template-based prompt construction from untrusted input; poisoned skill and tool descriptions. |
| LLM02: Sensitive Information Disclosure | Active detection | cross_tenant, hardcoded_credentials, logging_sensitive_data, pii_filter_wiring, skill_cross_origin, unsafe_env_access | Hardcoded credentials, unsafe environment access, sensitive data in logs, missing PII filters, cross-tenant leakage, cross-origin skill data. |
| LLM03: Excessive Agency | Active detection | excessive_permissions, goal_conflict_detection, missing_authz, missing_oversight, skill_autonomy_abuse, skill_excessive_permissions, token_validation | Missing authorization, missing human oversight, excessive permissions, missing token validation, goal conflicts, autonomous skill abuse. |
| LLM04: Supply Chain | Active detection | skill_supply_chain, supply_chain, unsafe_deserialization | Unpinned or untrusted model, tool, package, and skill sources; unsafe deserialization of model or tool artifacts. |
| LLM05: Data and Model Poisoning | Active detection | data_poisoning | Untrusted content written into retrieval stores or memory. |
| LLM06: Unbounded Consumption | Active detection | context_exhaustion, infinite_loop, missing_rate_limits, recursive_tool_calling, token_bombing | Infinite loops, recursive tool calling, token bombing, missing rate limits, context exhaustion. |
| LLM07: Misinformation | Active detection | overreliance | Overreliance on unverified model output. |
| LLM08: Hidden Context Exposure | Active detection | system_prompt_leak | System prompt and hidden context reachable from logs or user-facing output. |
| LLM09: Vector and Embedding Weaknesses | Active detection | rag_overfetching | Retrieval over-fetching without tenant or scope filters. |
| LLM10: Improper Output Handling | Active detection | command_injection, exec_eval, output_validation, path_traversal, sql_injection, ssrf | Model output reaching SQL, shell, eval, file paths, or HTTP targets without validation. |
Status definitions
- Active detection — At least one static-analysis rule stamps this category id on findings. Findings appear under the default balanced policy unless the rule is governance-tier.
- Governance only — Only governance-layer findings reference this category. They appear under the governance, eu-ai-act, and comprehensive policies, not under balanced or low-noise.
- Not mapped — No rule currently stamps this category id. Related rules exist but carry a different identifier; a scan will not report this category.
- Out of scope — Not detectable by static analysis of agent code (for example runtime or infrastructure controls). Inkog does not report this category.
LLM01: Prompt Injection
Status: Active detection. Direct and template-based prompt construction from untrusted input; poisoned skill and tool descriptions.
Rules:
| Rule | Severity | Tier | CWE |
|---|---|---|---|
prompt_injection — Prompt Injection Attack in System Prompt | HIGH | risk_pattern | CWE-74, CWE-94, CWE-200 |
prompt_template — Unvalidated Template Variables in System Prompt | HIGH | risk_pattern | CWE-94, CWE-74 |
skill_tool_poisoning — Tool Description Poisoning | CRITICAL | vulnerability | CWE-94, CWE-1021 |
LLM02: Sensitive Information Disclosure
Status: Active detection. Hardcoded credentials, unsafe environment access, sensitive data in logs, missing PII filters, cross-tenant leakage, cross-origin skill data.
Rules:
| Rule | Severity | Tier | CWE |
|---|---|---|---|
cross_tenant — Potential Cross-Tenant Data Leakage | CRITICAL | vulnerability | CWE-200, CWE-639 |
hardcoded_credentials — Hardcoded Credentials in System Prompt | CRITICAL | vulnerability | CWE-798, CWE-259 |
logging_sensitive_data — Sensitive Data in Prompts May Be Logged | MEDIUM | risk_pattern | CWE-532, CWE-117 |
pii_filter_wiring — Missing PII Filter Before External Communication | HIGH | vulnerability | CWE-359, CWE-532 |
skill_cross_origin — Cross-Origin Tool Escalation | HIGH | risk_pattern | CWE-346, CWE-441 |
unsafe_env_access — Unsafe Environment Variable Access | HIGH | risk_pattern | CWE-15, CWE-526 |
LLM03: Excessive Agency
Status: Active detection. Missing authorization, missing human oversight, excessive permissions, missing token validation, goal conflicts, autonomous skill abuse.
Rules:
| Rule | Severity | Tier | CWE |
|---|---|---|---|
excessive_permissions — Excessive Tool Permissions | MEDIUM | risk_pattern | CWE-250, CWE-269 |
goal_conflict_detection — Potential Agent Goal Conflict | MEDIUM | risk_pattern | CWE-362, CWE-667 |
missing_authz — Missing Authorization Check Before Tool Execution | HIGH | risk_pattern | CWE-862 |
missing_oversight — Agent Executes High-Risk Actions Without Human Approval | HIGH | risk_pattern | CWE-862, CWE-1113 |
skill_autonomy_abuse — Autonomy Abuse in Skill | HIGH | risk_pattern | CWE-862, CWE-770 |
skill_excessive_permissions — Excessive Permissions in Skill | HIGH | risk_pattern | CWE-250, CWE-269 |
token_validation — Missing Token Validation Before Sensitive Operation | HIGH | vulnerability | CWE-287, CWE-347, CWE-306 |
LLM04: Supply Chain
Status: Active detection. Unpinned or untrusted model, tool, package, and skill sources; unsafe deserialization of model or tool artifacts.
Rules:
| Rule | Severity | Tier | CWE |
|---|---|---|---|
skill_supply_chain — Skill Package Supply Chain Risk | HIGH | risk_pattern | CWE-829, CWE-494, CWE-1104 |
supply_chain — Supply Chain Vulnerability in Agent | HIGH | risk_pattern | CWE-829, CWE-494, CWE-1104 |
unsafe_deserialization — Unsafe Deserialization of LLM/Agent Output | HIGH | risk_pattern | CWE-502, CWE-915 |
LLM05: Data and Model Poisoning
Status: Active detection. Untrusted content written into retrieval stores or memory.
Rules:
| Rule | Severity | Tier | CWE |
|---|---|---|---|
data_poisoning — Data/Model Poisoning Risk | HIGH | risk_pattern | CWE-1039, CWE-471, CWE-472 |
LLM06: Unbounded Consumption
Status: Active detection. Infinite loops, recursive tool calling, token bombing, missing rate limits, context exhaustion.
Rules:
| Rule | Severity | Tier | CWE |
|---|---|---|---|
context_exhaustion — Unbounded Context Window Accumulation | MEDIUM | risk_pattern | CWE-770, CWE-400 |
infinite_loop — Unbounded Loop in Agentic System | HIGH | risk_pattern | CWE-835, CWE-400 |
missing_rate_limits — Missing Rate Limits on LLM Calls | LOW | hardening | CWE-770, CWE-799 |
recursive_tool_calling — Recursive Tool Calling Without Cycle Guard | MEDIUM | risk_pattern | CWE-674, CWE-400 |
token_bombing — Token Bombing — Unbounded Agent Loop Without Termination Guard | HIGH | risk_pattern | CWE-770, CWE-834 |
LLM07: Misinformation
Status: Active detection. Overreliance on unverified model output.
Rules:
| Rule | Severity | Tier | CWE |
|---|---|---|---|
overreliance — Overreliance on LLM Output for High-Risk Decisions | MEDIUM | risk_pattern | CWE-345, CWE-807, CWE-1113 |
LLM08: Hidden Context Exposure
Status: Active detection. System prompt and hidden context reachable from logs or user-facing output.
Rules:
| Rule | Severity | Tier | CWE |
|---|---|---|---|
system_prompt_leak — System Prompt Leakage (OWASP LLM08:2026) | HIGH | risk_pattern | CWE-209, CWE-532 |
LLM09: Vector and Embedding Weaknesses
Status: Active detection. Retrieval over-fetching without tenant or scope filters.
Rules:
| Rule | Severity | Tier | CWE |
|---|---|---|---|
rag_overfetching — RAG Over-Fetching - Unbounded Document Retrieval | LOW | hardening | CWE-400, CWE-770 |
LLM10: Improper Output Handling
Status: Active detection. Model output reaching SQL, shell, eval, file paths, or HTTP targets without validation.
Rules:
| Rule | Severity | Tier | CWE |
|---|---|---|---|
command_injection — OS Command Injection | CRITICAL | vulnerability | CWE-78 |
exec_eval — Unvalidated Code Execution in Agent Tool | HIGH | risk_pattern | CWE-94, CWE-95, CWE-78 |
output_validation — Unvalidated LLM Output Usage | MEDIUM | risk_pattern | CWE-20, CWE-116 |
path_traversal — Path Traversal Vulnerability | HIGH | risk_pattern | CWE-22, CWE-73, CWE-434 |
sql_injection — SQL Injection via LLM-Generated Query | HIGH | risk_pattern | CWE-89, CWE-564 |
ssrf — SSRF via LLM-Generated URL in Agent Tool | HIGH | vulnerability | CWE-918 |
OWASP Top 10 for Agentic Applications (2026)
OWASP Top 10 for Agentic Applications 2026. Generated from the rule engine’s metadata; do not edit by hand.
| Category | Status | Rules that stamp this id |
|---|---|---|
| ASI01: Agent Goal Hijack | Active detection | goal_conflict_detection, prompt_injection, prompt_template, skill_tool_poisoning |
| ASI02: Tool Misuse and Exploitation | Active detection | output_validation, path_traversal, sql_injection, ssrf |
| ASI03: Identity and Privilege Abuse | Active detection | cross_tenant, excessive_permissions, hardcoded_credentials, missing_authz, skill_excessive_permissions, token_validation, unsafe_env_access |
| ASI04: Agentic Supply Chain Vulnerabilities | Active detection | skill_supply_chain, supply_chain |
| ASI05: Unexpected Code Execution | Active detection | command_injection, exec_eval, unsafe_deserialization |
| ASI06: Memory and Context Poisoning | Active detection | data_poisoning, rag_overfetching |
| ASI07: Insecure Inter-Agent Communication | Active detection | skill_cross_origin, unsigned_messages |
| ASI08: Cascading Failures | Active detection | context_exhaustion, infinite_loop, missing_rate_limits, recursive_tool_calling, token_bombing |
| ASI09: Human-Agent Trust Exploitation | Active detection | overreliance, skill_autonomy_abuse |
| ASI10: Rogue Agents | Active detection | missing_oversight |
Reading OWASP ids in scan output
inkog -path ./agents -output json \
| jq '[.server_findings[] | {id: .pattern_id, owasp: .compliance_mapping.owasp_items}]'Findings from governance checks (for example missing_human_oversight) only appear under the governance, eu-ai-act, and comprehensive policies. See Security Policies for what each policy filters.
Resources
- OWASP GenAI LLM Top 10 2026
- OWASP Top 10 for Agentic Applications 2026
- Vulnerability database — the same mapping, grouped by vulnerability class