OWASP LLM Top 10 2026 Scanning Checklist by Layer

The OWASP Top 10 for LLM Applications is the closest thing the industry has to a shared vocabulary for LLM application risk, but the list itself is not a test plan. This OWASP LLM Top 10 scanning checklist translates the 2026 edition, published on 3 August 2026, into concrete scanning tasks: what to probe for each entry, which layer the scan belongs at, and which tools currently cover it. If your tools or audit reports still use the 2025 numbering, the crosswalk below maps one to the other. One caveat up front: no single scanner covers all ten entries, and at least three of them (supply chain, excessive agency, poisoning) are only partially scannable at all. Treat scan results as one input to a layered control set, not a clean bill of health.

Know your three scanning layers first

Every entry on the list maps to one of three places in the pipeline, and picking the wrong layer is the most common way teams waste an evaluation.

Build-time (static). Scanning model artifacts, dependencies, and datasets before anything runs. This is where supply-chain and some poisoning checks live. It looks more like traditional SCA than LLM testing.

Pre-deployment (adversarial probing). Firing structured attack payloads at a candidate model or application and grading the responses. This is the home turf of the open-source scanners: garak, NVIDIA’s Apache-2.0 scanner that, per its repo, “checks if an LLM can be made to fail in a way we don’t want” with probe modules for prompt injection, jailbreaks, data leakage, toxicity, and XSS-via-output; PyRIT, Microsoft’s risk-identification framework for generative AI red teaming; and promptfoo, whose docs map its red-team plugins explicitly onto the OWASP list, down to an owasp:llm shorthand that activates coverage for all ten entries. As of October 2026 that mapping still follows the 2025 numbering, so owasp:llm:03 runs Supply Chain checks, not 2026’s LLM03 Excessive Agency. Select plugins by name or by the 2025 ID until the docs change.

Runtime (guardrails and monitoring). Input/output filtering, tool allowlists, and rate controls on the live system. Scanning validates these controls exist and hold; it does not replace them. For the guardrail side of that equation, guardml.io tracks the defensive tooling landscape in more depth than we will here.

2026 vs 2025: the crosswalk

The 2026 list moved more than past editions did. OWASP weighted a community vote at three quarters and real-world incident data at one quarter, and the order shifted accordingly.

OWASP also draws a boundary in the 2026 edition. This list covers the model as a component inside your application. Once the model acts, with tools it can call, memory it keeps between sessions and consequences downstream, OWASP assigns the risk to its Top 10 for Agentic Applications, so scan agent behaviour against that list as well.

The checklist, entry by entry

• LLM01:2026 Prompt Injection. Probe direct injection (jailbreak templates, encoding tricks, role-play overrides) and indirect injection (payloads planted in documents your RAG pipeline will retrieve). garak’s injection and jailbreak probe families and promptfoo’s owasp:llm:01 plugin set both cover the direct case; indirect injection needs test corpora seeded into your actual retrieval path. The offensive side of this technique moves fast: aisec.blog covers current injection and agent-exploitation tradecraft if you need attacker-realistic payloads. The 2026 entry also covers cross-modal injection: if your application accepts images or audio, include payloads hidden in those inputs.

• LLM02:2026 Sensitive Information Disclosure. Seed known canary strings (fake PII, fake API keys) into system prompts, fine-tuning data, and RAG context, then scan for their reappearance in outputs. promptfoo ships dedicated pii:direct, pii:api-db, and pii:session plugins per its docs; garak’s leakage probes cover the model-memorization angle.

• LLM03:2026 Excessive Agency (2025: LLM06). Mostly a design-review item, not a scanning item. promptfoo’s excessive-agency and rbac plugins can probe whether an agent exceeds its intended permissions, but the primary control is a reviewed tool allowlist with least-privilege scopes. A scan can confirm the allowlist holds; it cannot tell you the allowlist is sensible.

• LLM04:2026 Supply Chain (2025: LLM03). Build-time, not prompt-time. Scan model artifacts for unsafe deserialization (pickle-based formats remain the classic vector), verify checksums and provenance for third-party models and adapters, and keep an SBOM for the serving stack. promptfoo’s ModelAudit component does static artifact scanning; conventional SCA tooling covers the Python dependency tree. The 2026 entry adds the case where a promoted model artifact is not what it claims to be, so pin and check hashes at promotion as well as at download.

• LLM05:2026 Data and Model Poisoning (2025: LLM04). The weakest link in any scanning checklist. Behavioral probing can surface crude backdoors (trigger phrases producing anomalous outputs), but a competently poisoned model will pass. Dataset provenance controls and training-data filtering do more here than any scanner; be suspicious of vendors implying otherwise. The 2026 entry folds in fine-tuning subversion, so the same provenance controls apply to fine-tuning data and adapters.

• LLM06:2026 Unbounded Consumption (2025: LLM10). Test rate limits, token caps, and cost ceilings under adversarial load: repetition-inducing prompts (promptfoo’s divergent-repetition plugin), oversized inputs, and concurrent-request floods. This overlaps with ordinary load testing; the difference is that the attacker controls per-request cost.

• LLM07:2026 Misinformation (2025: LLM09). This is evaluation more than scanning, because hallucination checks need ground truth to grade against. Build a domain-specific eval set and run it on every model or prompt change; generic hallucination probes (both garak and promptfoo include them) catch only the egregious cases.

• LLM08:2026 Hidden Context Exposure (2025: LLM07 System Prompt Leakage). Hidden context is wider than the system prompt. OWASP’s 2026 entry includes developer instructions, policy text retrieved from RAG stores or configuration services, and the schemas of the tools and functions the model can call. Run prompt-extraction probes (promptfoo ships one; garak’s leakage probes overlap) against all of it, ask the model to list its tools and their parameters, and audit what your application assembles into the context window. The durable mitigation is architectural and matches OWASP’s own advice: assume hidden context is discoverable, keep credentials and tokens out of it, and never rely on its secrecy for authorization or content filtering.

• LLM09:2026 Vector and Embedding Weaknesses (2025: LLM08). Scan the RAG layer specifically: indirect injection through retrieved chunks, cross-tenant retrieval (does user A’s query surface user B’s documents), and access control on the vector store. promptfoo’s bola, bfla, and indirect-injection plugins target this entry per its docs.

• LLM10:2026 Improper Output Handling (2025: LLM05). Treat model output as untrusted input to downstream systems. Scan for outputs that survive into HTML, SQL, or shell contexts unescaped (garak includes XSS-oriented probes), and add output-validation assertions (JSON-schema enforcement where structure is expected) to your CI evals. The 2026 entry also spans insecure code that coding assistants generate, so if model-written code ships, run your normal static analysis on it.

What this checklist will not catch

Scanning is point-in-time; LLM behavior is not. A model version bump, a system-prompt edit, or new retrieval content can reopen a finding you closed last quarter, so the checklist only earns its keep wired into CI as a regression gate rather than run as an annual exercise. That framing matches the Measure function in the NIST AI Risk Management Framework, whose Generative AI Profile (NIST-AI-600-1, released July 2024) is the reference we would hand an auditor asking why scan cadence matters.

The residual risk is concentrated in the entries scanners handle worst: Supply Chain (LLM04) and Data and Model Poisoning (LLM05) are provenance and process problems, Excessive Agency (LLM03) is an architecture problem, and Misinformation (LLM07) needs domain ground truth no vendor can ship you. Expect a scanner to give you strong coverage on injection, leakage, extraction, and output handling, roughly six of the ten entries, and plan governance controls for the rest.

Working the checklist tells you which entries your current tooling covers; it does not tell you which category of tool to add for the gaps. That mapping — scanner, framework, detector, guardrail, gateway, artefact scanner — is in LLM Security Tools: The 2026 Category Map, and the interactive scanner picker turns your constraints into a ranked shortlist.

Related across the network

• OWASP LLM Top 10 2026: Mitigations for Every Risk — aisecreviews.com