Add OWASP Top 10 for LLM Applications 2026 as a mapped resource

[rocklambros]

The ask

The 2026 edition of the OWASP Top 10 for LLM Applications is out and OpenCRE doesn't carry it yet. I'd like to add it as a new resource and do the mapping work myself. I co-lead the project, so I can supply the source document and answer questions about what any entry was meant to cover.

I need a yes to proceed, and a pick between the two routes at the bottom.

I'm opening an issue instead of a PR because CONTRIBUTING.md asks contributors to wait for a maintainer to acknowledge a ticket first.

Why it needs its own resource name

OpenCRE serves OWASP Top10 for LLM today and its sections are named for the 2025 edition, like LLM01:2025 Prompt Injection.

The 2026 edition reshuffled the list. Eight of the ten IDs now point somewhere different than they did in 2025:

ID	2025	2026
LLM01	Prompt Injection	Prompt Injection
LLM02	Sensitive Information Disclosure	Sensitive Information Disclosure
LLM03	Supply Chain	Excessive Agency
LLM04	Data and Model Poisoning	Supply Chain
LLM05	Improper Output Handling	Data and Model Poisoning
LLM06	Excessive Agency	Unbounded Consumption
LLM07	System Prompt Leakage	Misinformation
LLM08	Vector and Embedding Weaknesses	Hidden Context Exposure
LLM09	Misinformation	Vector and Embedding Weaknesses
LLM10	Unbounded Consumption	Improper Output Handling

LLM08 is worth a closer look, because it's the one entry that isn't just a renumber. System Prompt Leakage became Hidden Context Exposure, and the scope widened past the system prompt to anything the application assembles into the context window, including developer instructions, policy text pulled from RAG, and the schemas of tools the model can call. A mapping inherited from the 2025 entry would miss most of that.

If both editions shared a resource name, /smartlink/standard/OWASP Top10 for LLM/LLM03 resolves to Supply Chain or Excessive Agency depending on which import ran last. You already split OWASP Top 10 2017 and OWASP Top 10 2021 for the same reason.

None of this touches the 2025 resource. It stays as it is.

How I'd build the mapping

I'd go through the CRE catalog entry by entry with the mapping template spreadsheet, putting each 2026 entry's name, ID, and link on the row of the Common Requirement that fits.

A few of the entries are finer grained than anything in the catalog right now. Where that happens I'll propose a new child requirement with the NEW|<name> convention rather than stretch an existing CRE to cover it.

I won't build any of it from CWE or another standard already in OpenCRE. CONTRIBUTING.md warns that detail gets lost that way and I agree, particularly for the entries about agent behavior rather than a code defect.

Pick a route

Route A is the spreadsheet. I fill in CREmappingtemplate.xls, attach it here, and you review it before anything imports. That's the path CONTRIBUTING.md lays out for content.

Route B is code. I add the 2026 fixture under application/tests/fixtures/owasp_mappings/, the parser, a test next to owasp_llm_top10_2025_parser_test.py, and the CLI and scripts/import-all.sh wiring. Route B rides on the importer pattern in #960, so it waits for #960 to land.

Say A or B and I'll start.

Duplicate check

I read through the open and closed issues and the open PRs before filing. #960 is the closest thing, and it covers the 2025 edition and the importer plumbing rather than 2026 content.

[robvanderveer]

Great idea. Approved.

Route A and B is best discussed in the team as it depends on the current GSOC progress.

Suggestions/input:
This mapping table may be helpful in your work.
I'm quite interested in your mapping suggestions.
My 2 cents is that context disclosure is a form of data disclosure in model output. At the same time it seens ti is also be a form of augmentation data confidentiality, but that's not the case since that is a conventional attack on context data. So you either separate disclosure in model output into 1) training data disclosure, 2) input and augmnentation data disclosure, and link the latter to the LLM entry.

Sidestep: you could wonder if the reshuffling of LLM entries is worth the hassle for the community. The benefit is that you get to create excitement every year about the order. But the price to pay is that it's not backwards compatible.
Also: I haven't seen the deeplinks to the 2026 entries work. We would want to refer to those.