Unofficial checklist · OWASP 2026
Review one LLM application against practical controls for the OWASP Top 10 for LLM Applications 2026. Record evidence, gaps, and next actions without sending assessment data anywhere.
This checklist adapts selected mitigation guidance from the OWASP Top 10 for LLM Applications 2026, licensed under CC BY-SA 4.0. Decision Terrain changed the wording, selection, completion criteria, evidence examples, and interaction format; this adapted checklist content is also offered under CC BY-SA 4.0. OWASP did not create, review, sponsor, or endorse it. Self-reported answers do not establish OWASP conformance, certification, compliance, security, safety, or readiness to deploy. OWASP and the OWASP logo are trademarks of the OWASP Foundation, Inc.
A security review for one application
Use In place only when you can point to implementation evidence. Record the gap and next action when the control is absent, incomplete, or untested. Explain every Not applicable answer.
Answers stay in this browser’s local storage and are not uploaded by this tool. Export a JSON backup before clearing browser data. Other scripts on this site can access this origin’s local storage. Keep entries unclassified and non-sensitive; do not enter CUI, secrets, or operational details.
Assume untrusted content can steer the model, then contain the consequences.
The threat model covers direct prompts, retrieved content, files, webpages, tool responses, memory, images, audio, and other content that can enter model context.
Evidence to look for: Context dataflow, trust-boundary diagram, modality inventory, content provenance rules.
Related OWASP risk: LLM01:2026
Credentials and state-changing authority stay outside the model, downstream actions use strict schemas and deterministic policy checks, and privileged or irreversible actions require appropriate confirmation.
Evidence to look for: Policy gateway, tool scopes, schema validation, approval flow, authorization tests.
Related OWASP risk: LLM01:2026
Adversarial tests cover direct, indirect, encoded, multilingual, multimodal, retrieval, tool-output, and persistent-memory injection paths that apply to this system.
Evidence to look for: Injection test suite, attack-path results, regression thresholds, remediation records.
Related OWASP risk: LLM01:2026
Minimize protected data exposure across context, retrieval, output, and operations.
Only task-required data enters prompts and provider calls; corpora are classified and scrubbed; secrets stay out of prompts; and training, retention, and logging settings are technically enforced.
Evidence to look for: Data classification, context templates, redaction controls, provider settings, retention configuration.
Related OWASP risk: LLM02:2026
Document and chunk authorization occurs inside retrieval, tenant isolation matches data sensitivity, and reasoning traces, logs, and confidence data are restricted as sensitive outputs.
Evidence to look for: Retrieval ACL tests, tenant design, trace access controls, DLP and logging configuration.
Related OWASP risk: LLM02:2026
Release testing probes memorization, membership inference, cross-session leakage, embedding inversion, and side channels where relevant, with an incident playbook for disclosure.
Evidence to look for: Disclosure red-team results, quantitative thresholds, incident playbook, cleanup and notification steps.
Related OWASP risk: LLM02:2026
Constrain tools, permissions, autonomy, and the impact of model-directed actions.
The agent receives only the tools and granular functions required for its intended use; obsolete and open-ended capabilities such as unrestricted shell or URL access are removed or tightly replaced.
Evidence to look for: Tool inventory, function allowlist, removed-tool record, constrained tool schemas.
Related OWASP risk: LLM03:2026
Each tool uses minimum downstream permissions, preserves the initiating user's identity and scope across calls, and receives authorization from deterministic application logic rather than the model.
Evidence to look for: OAuth scopes, service identities, permission tests, policy-decision logs, delegation design.
Related OWASP risk: LLM03:2026
High-impact actions require human approval, tool activity is auditable, and thresholds or circuit breakers halt, limit, or escalate abnormal action volume or value.
Evidence to look for: Approval rules, tool audit logs, action limits, circuit-breaker tests, escalation runbook.
Related OWASP risk: LLM03:2026
Verify the models, data, software, adapters, services, and artifacts you depend on.
A current inventory covers application packages, models, datasets, adapters, prompts or templates, conversion steps, services, and licenses, using SBOM, AIBOM, or ML-BOM records where useful.
Evidence to look for: Signed inventory, dependency lockfiles, model and dataset register, license record.
Related OWASP risk: LLM04:2026
Models, adapters, datasets, code, and transformed artifacts come from verifiable sources and are pinned to immutable references with signatures, hashes, or equivalent integrity checks before promotion.
Evidence to look for: Artifact attestations, checksums, immutable digests, promotion gates, conversion or merge audit.
Related OWASP risk: LLM04:2026
Suppliers, terms, privacy practices, components, and model behavior are reviewed before adoption and again after material changes, with vulnerability management and use-specific evaluation in production.
Evidence to look for: Supplier reviews, terms assessment, scan results, patch policy, third-party evaluation and monitoring.
Related OWASP risk: LLM04:2026
Protect persistent data and model behavior from durable, attacker-controlled change.
Training, fine-tuning, retrieval, feedback, memory, and inference artifacts have traceable lineage, version history, integrity checks, least-privilege write access, and a tested rollback path.
Evidence to look for: Dataset and model lineage, access matrix, signed versions, change history, rollback test.
Related OWASP risk: LLM05:2026
External data, user feedback, retrieved content, model artifacts, templates, and adapters pass source validation, trust scoring, isolation, or human review before they can persistently influence behavior.
Evidence to look for: Ingestion policy, source scoring, quarantine flow, reviewer records, feedback-loop controls.
Related OWASP risk: LLM05:2026
Monitoring and adversarial evaluation look for anomalous training loss, embedding behavior, output drift, trigger responses, and post-alignment backdoors against defined thresholds.
Evidence to look for: Drift dashboard, anomaly rules, trigger-probing suite, red-team results, investigation tickets.
Related OWASP risk: LLM05:2026
Bound inference, tool use, time, and cost before usage becomes disruption or loss.
Enforced limits cover input size, request rate, tokens, modalities, users, sessions, teams, and estimated cost, with preflight rejection before expensive inference begins.
Evidence to look for: Quota configuration, token estimator, per-identity limits, modality budgets, rejection tests.
Related OWASP risk: LLM06:2026
Non-overridable spending ceilings and agent circuit breakers stop work at defined limits for steps, recursion depth, time, queued actions, tool fan-out, and per-run cost.
Evidence to look for: Budget caps, step and time limits, loop detection, circuit-breaker tests, failure behavior.
Related OWASP risk: LLM06:2026
Usage is attributed to responsible identities, recursive or abnormal tool behavior is detected, serving infrastructure is hardened, and overload produces graceful degradation rather than uncontrolled failure.
Evidence to look for: Cost dashboards, anomaly alerts, capacity tests, degradation plan, inference patch records.
Related OWASP risk: LLM06:2026
Keep unsupported or incorrect output from driving consequential decisions or actions.
Outputs that can influence decisions or actions cite authoritative, current evidence, distinguish verified facts from assumptions, and use required fields that make missing support visible.
Evidence to look for: Grounding design, source policy, structured output schema, citation and omission tests.
Related OWASP risk: LLM07:2026
Generation is separated from execution, and trusted code verifies claims, arguments, authorization, preconditions, and current system state before a consequential tool call or workflow transition.
Evidence to look for: Claim-check-act design, precondition checks, state validation, approval logs, failure tests.
Related OWASP risk: LLM07:2026
Evaluation and monitoring cover false claims, critical omissions, fabricated evidence, misleading summaries, and cross-agent propagation, with outcomes traced back to the supporting evidence.
Evidence to look for: Misinformation test set, adversarial cases, claim and evidence logs, outcome review process.
Related OWASP risk: LLM07:2026
Design as if system instructions and operational context can be discovered.
System prompts, developer instructions, tool descriptions, and retrieved policy context contain no credentials, tokens, connection strings, regulated data, or security-critical configuration.
Evidence to look for: Prompt and context review, secret scan, externalized credential design, context inventory.
Related OWASP risk: LLM08:2026
Authorization, privilege separation, safety enforcement, validation, and other critical behavior are implemented by deterministic, auditable systems rather than the confidentiality or obedience of hidden instructions.
Evidence to look for: Control architecture, policy enforcement code, authorization tests, independent safeguard results.
Related OWASP risk: LLM08:2026
Context is separated by authorization need, reveals no unnecessary tool or policy detail, and is tested to confirm that extraction or inference would not directly grant access or bypass a control.
Evidence to look for: Role-specific context templates, context minimization review, extraction tests, impact assessment.
Related OWASP risk: LLM08:2026
Treat similarity search and embeddings as part of the application trust boundary.
Tenant, trust-zone, document, and chunk authorization is enforced server-side within the index query, with separated indexes for high-sensitivity or mixed-trust workloads where warranted.
Evidence to look for: Vector query filters, isolation design, cross-tenant tests, endpoint authentication and limits.
Related OWASP risk: LLM09:2026
Content is normalized before embedding, every vector records its source, ingestion time, trust tier, and pipeline version, and external content receives review appropriate to the target index.
Evidence to look for: Embedding metadata, normalization controls, trust-tier indexes, ingestion review and audit trail.
Related OWASP risk: LLM09:2026
Embeddings are treated like source data: encrypted, deleted with their source, re-created after model changes, withheld from raw score disclosure, and monitored for inversion, probing, poisoning, and retrieval anomalies.
Evidence to look for: Encryption and deletion controls, reconciliation audit, re-embedding plan, anomaly alerts, incident playbook.
Related OWASP risk: LLM09:2026
Treat model output as untrusted input everywhere it is rendered or executed.
Trusted application code treats model output as untrusted input, applies strict structural and semantic validation, and uses parameterized operations instead of sending generated content directly to shells, databases, files, or APIs.
Evidence to look for: Output schemas, validators, prepared statements, sink inventory, negative security tests.
Related OWASP risk: LLM10:2026
Output receives context-specific encoding, control characters are neutralized, browser protections are enforced, and rendered model content cannot automatically fetch attacker-controlled images, previews, frames, or other resources.
Evidence to look for: Encoding library, CSP, renderer configuration, control-character tests, outbound allowlist or proxy.
Related OWASP risk: LLM10:2026
Security testing covers each place model output is displayed, logged, compiled, executed, queried, emailed, or passed to another system, and generated code receives review and testing before production use.
Evidence to look for: Output dataflow, sink-specific test cases, monitoring rules, generated-code review gate, findings log.
Related OWASP risk: LLM10:2026
Source, license, and method
The source is the August 2026 OWASP Top 10 for LLM Applications 2026. Decision Terrain selected mitigation themes and rewrote them as three completion-oriented checks per risk. We added project-authored evidence examples, statuses, system fields, JSON format, and print layout. The risk IDs show where to read the complete description, examples, mitigations, scenarios, mappings, and references; a completed check is not a claim that every recommendation in that OWASP entry has been implemented.
This checklist covers an LLM used as a component in an application. If the system can plan, use tools, retain memory, coordinate with other agents, or take consequential actions, pair it with the official OWASP Top 10 for Agentic Applications 2026. Use our general AI RMF checklist and Generative AI Profile checklist for broader governance and risk-management questions. Also keep ordinary application, API, identity, cloud, and supply-chain security controls in scope.
Original OWASP material and this adapted checklist content are available under Creative Commons Attribution-ShareAlike 4.0. Checklist version 0.1.0-draft; source reviewed September 22, 2026.