---
description: "The OWASP LLM Top 10 for 2026 mapped to AI gateway controls: which risks Bifrost covers, which it covers in part, and which need controls elsewhere."
title: "OWASP LLM Top 10: How to Cover Each Risk at the Gateway"
image: https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w1200/2026/10/owasp-llm-top-10-how-to-cover-each-risk-at-the-gateway-bifrost-1920x1080.png
---

Try Bifrost Enterprise free for 14 days. [Request access](https://www.getmaxim.ai/#enterprise-trial)

**TL;DR**

- The OWASP LLM Top 10 for 2026 keeps Prompt Injection at LLM01, moves Excessive Agency up to LLM03, and renames System Prompt Leakage to Hidden Context Exposure (LLM08).
- An AI gateway fully covers Unbounded Consumption (LLM06) and partially covers prompt injection, sensitive information disclosure, excessive agency, and hidden context exposure.
- Supply chain, data and model poisoning, and vector and embedding weaknesses mostly need controls in the build pipeline and retrieval layer, not at the gateway.
- Bifrost applies guardrails, PII redaction, secrets detection, virtual key budgets and rate limits, and deny-by-default MCP tool filtering on the request path, with 11 microseconds of gateway overhead at 5,000 RPS.
- No single control closes any OWASP LLM risk; the gateway is one deterministic layer that the model cannot talk its way past.

The OWASP LLM Top 10 is the OWASP GenAI Security Project's ranked list of the ten most critical security risks in applications built on large language models, and its 2026 edition reorders that list using thousands of real incidents. [Bifrost](https://www.getmaxim.ai/bifrost), the [open-source AI gateway](https://github.com/maximhq/bifrost) built by Maxim AI for enterprises running mission-critical AI workloads, sits on the one path where many of these risks can be enforced: the model calls and MCP tool calls an application makes. This guide walks each of the ten 2026 risks, marks whether a gateway covers it, covers it in part, or needs controls elsewhere, and names the specific Bifrost controls that apply.

## What Is the OWASP Top 10 for LLM Applications?

The OWASP Top 10 for LLM Applications is a community-built ranking of the most critical security risks in software that uses large language models, with descriptions, attack scenarios, and mitigations for each. The current edition is the [OWASP GenAI LLM Top 10 2026](https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/), published by the OWASP GenAI Security Project in August 2026.

The 2026 edition is the first to test the practitioner vote against incident data: 6,639 classified real-world incidents, weighted at one-quarter against the community vote at three-quarters. The [September 2026 announcement](https://genai.owasp.org/announcement/owasp-genai-security-project-unveils-2026-top-10-for-llm-applications-new-agent-control-standard-and-sponsors-as-community-tops-30000-members/) reports more than 10,000 downloads in the first 48 hours.

Many threat models still cite the [2025 numbering](https://genai.owasp.org/llm-top-10/), so the cross-walk below is worth checking:

| 2026 ID | 2026 risk | 2025 ID and name |
| --- | --- | --- |
| LLM01:2026 | Prompt Injection | LLM01:2025 Prompt Injection |
| LLM02:2026 | Sensitive Information Disclosure | LLM02:2025 Sensitive Information Disclosure |
| LLM03:2026 | Excessive Agency | LLM06:2025 Excessive Agency |
| LLM04:2026 | Supply Chain | LLM03:2025 Supply Chain |
| LLM05:2026 | Data and Model Poisoning | LLM04:2025 Data and Model Poisoning |
| LLM06:2026 | Unbounded Consumption | LLM10:2025 Unbounded Consumption |
| LLM07:2026 | Misinformation | LLM09:2025 Misinformation |
| LLM08:2026 | Hidden Context Exposure | LLM07:2025 System Prompt Leakage |
| LLM09:2026 | Vector and Embedding Weaknesses | LLM08:2025 Vector and Embedding Weaknesses |
| LLM10:2026 | Improper Output Handling | LLM05:2025 Improper Output Handling |

The LLM list covers the model as a component inside an application; once the model acts with tools and memory, OWASP points readers to its separate Top 10 for Agentic Applications as well. Bifrost sits on both sides of that boundary because it brokers model calls and [MCP tool execution](https://www.getmaxim.ai/bifrost/resources/mcp-gateway) through the same governance layer, which is why the broader [guide to LLM gateway security for prompt injection, PII, and audit](https://www.getmaxim.ai/articles/llm-gateway-security-prompt-injection-pii-audit-compliance/) treats them together.

## What an AI Gateway Can and Cannot Cover

An AI gateway can enforce controls on the traffic it brokers: who is calling, which models and tools they can reach, what content goes in and out, and how much they can spend. It cannot see training data, model weights, retrieval indexes, or what an application does with a response afterward.

That boundary decides the rating for each risk in this guide. [Bifrost](https://www.getmaxim.ai/bifrost) routes requests to [25+ providers and 10,000+ models](https://docs.getbifrost.ai/providers/supported-providers/overview) through one OpenAI-compatible API, so every model call and MCP tool call through it passes the same identity, guardrail, and budget checks.

![Apps and agents reach model providers and MCP tool servers through the Bifrost AI gateway, while RAG indexes, output renderers, and training pipelines sit outside that path](https://articles-images-cdn.t3.tigrisfiles.io/diagrams/owasp-llm-top-10/owasp-llm-top-10-gateway-boundary.png)

*Figure 1: The gateway enforces policy on the traffic it brokers; data pipelines, retrieval indexes, and output renderers need their own controls.*

Two operational details make the gateway layer reliable rather than advisory:

- **Mandatory identity.** Enforcing authentication on inference makes every request present a [virtual key](https://docs.getbifrost.ai/features/governance/virtual-keys), so no traffic skips policy checks.
- **Low overhead.** Bifrost adds [11 microseconds of overhead per request at 5,000 RPS](https://www.getmaxim.ai/bifrost/resources/benchmarks) in sustained benchmarks; guardrail providers add their own evaluation time on top.

## The OWASP LLM Top 10 Mapped to Gateway Controls

The OWASP LLM Top 10 splits into three groups at the gateway: one risk the gateway covers directly (Unbounded Consumption), five it covers in part, and four that depend mainly on controls in the application, data pipeline, or build process. The sections after the table explain each rating.

| Risk | Gateway coverage | Bifrost controls that apply | Controls needed elsewhere |
| --- | --- | --- | --- |
| LLM01 Prompt Injection | Partially covered | Input and MCP tool-result guardrails, prompt-injection detection from integrated providers, Prompt Guardrails policies | Least-privilege tools, trust separation of retrieved content, red teaming |
| LLM02 Sensitive Information Disclosure | Partially covered | Secrets Detection, Custom Regex PII template, Presidio and Azure AI Language PII, redaction modes, per-key content logging | Training-data hygiene, authorization before retrieval, corpus governance |
| LLM03 Excessive Agency | Partially covered | Deny-by-default MCP tool filtering per virtual key, auto-execute allow-lists, agent depth limit, MCP argument guardrails, per-user MCP auth | Narrow tool implementations, downstream database and API permissions |
| LLM04 Supply Chain | Needs controls elsewhere | Per-key model and provider allow-lists | Model provenance, SBOMs, artifact signing, dependency scanning |
| LLM05 Data and Model Poisoning | Needs controls elsewhere | Request logs for behavior review | Data validation, dataset provenance, fine-tuning pipeline controls |
| LLM06 Unbounded Consumption | Covered at the gateway | Hierarchical budgets, token and request rate limits, agent depth limit, budget alerts | Sandboxed network egress for the application |
| LLM07 Misinformation | Needs controls elsewhere | Hallucination detection via an integrated provider, Prompt Guardrails policies | Grounding, claim-check-act workflows, human review |
| LLM08 Hidden Context Exposure | Partially covered | Secrets Detection on prompts, Secret Management for provider keys, access enforced outside the model | Keep secrets and authorization logic out of prompts |
| LLM09 Vector and Embedding Weaknesses | Needs controls elsewhere | Identity-scoped semantic cache entries | Tenant scoping inside the index query, ingest validation |
| LLM10 Improper Output Handling | Partially covered | Output guardrails, MCP argument inspection before execution | Context-aware encoding, parameterized queries, CSP |

The gateway is strongest where OWASP's own mitigations call for deterministic enforcement outside the model, such as spending caps and tool allow-lists, and weakest where the risk lives in data the gateway never handles. Teams building out the full [Bifrost governance layer](https://www.getmaxim.ai/bifrost/resources/governance) should treat the "elsewhere" column as part of the same plan.

## Prompt Injection and Hidden Context Exposure

Prompt injection (LLM01) and Hidden Context Exposure (LLM08) are both partially covered at the gateway. Bifrost can inspect prompts, tool results, and responses for injected instructions and leaked secrets, but OWASP calls injection intrinsic to current models, so detection reduces the risk rather than removing it.

### LLM01:2026 Prompt Injection

OWASP states the root cause directly: LLMs make no architectural distinction between instructions and data, so retrieved documents and tool output can carry instructions too. Checkpoints belong wherever untrusted content enters the context window.

![A user prompt passes an input guardrail before reaching the model, a tool result passes an MCP output guardrail before re-entering context, and the response passes an output guardrail](https://articles-images-cdn.t3.tigrisfiles.io/diagrams/owasp-llm-top-10/owasp-llm-top-10-injection-checkpoints.png)

*Figure 2: Indirect prompt injection arrives through tool results, so the tool boundary needs its own guardrail, not only the user prompt.*

[Bifrost Enterprise guardrails](https://docs.getbifrost.ai/enterprise/guardrails) apply rules at two targets. LLM rules run before and after the provider call; MCP rules run on tool arguments before execution and on tool results before they return. Each rule is a CEL expression linked to one or more detector profiles:

- **Prompt-injection detection** from integrated providers, including AWS Bedrock Guardrails, Azure Content Safety, Google Model Armor, Gray Swan, Patronus AI, Check Point's AI Agent Security, and Repello Argus.
- **Indirect prompt injection detection** from Azure Content Safety, Google Model Armor, and Gray Swan, for content arriving through retrieval and tools.
- [**Prompt Guardrails**](https://docs.getbifrost.ai/enterprise/guardrails/prompt-guardrails), an LLM judge that allows or blocks content against an organization's natural-language policy.

The gateway cannot make injection impossible. When a novel injection passes every detector, the remaining defense is what the model is allowed to do next, which is why LLM03 controls matter as much as LLM01 controls. The [prompt injection defense guide for production AI agents](https://www.getmaxim.ai/articles/prompt-injection-defense-for-production-ai-agents-a-complete-2026-guide/) covers application-side patterns.

### LLM08:2026 Hidden Context Exposure

Hidden Context Exposure replaces System Prompt Leakage and widens it to any non-user-facing context: system prompts, retrieved policy text, and tool schemas. OWASP's guidance is to assume hidden context is discoverable, keep credentials out of it, and enforce authorization and behavior through deterministic systems outside the model.

A gateway is one of those systems. In Bifrost, model access, tool access, and spending are attached to the virtual key, not described in a system prompt, so leaking the prompt does not leak the permissions.

[Secrets Detection](https://docs.getbifrost.ai/enterprise/guardrails/secrets-detection) scans request text and can block credentials before they reach a provider. [Secret Management](https://docs.getbifrost.ai/enterprise/secret-management) keeps provider keys and virtual key values in AWS Secrets Manager, GCP Secret Manager, or HashiCorp Vault instead of plaintext config. Keeping exploitable business rules out of the prompt itself remains an application design decision.

## Sensitive Information Disclosure: PII Redaction and Secrets Detection

Sensitive Information Disclosure (LLM02) is partially covered at the gateway. Bifrost can detect, block, or redact PII and credentials in prompts, responses, tool arguments, tool results, and its own logs. It cannot undo memorization from training or stop an application from retrieving documents a user should not see.

OWASP treats every channel as a disclosure surface, including tool-call arguments, logs, and telemetry. Bifrost covers the channels that pass through it:

- **Secrets Detection** runs inside Bifrost on the embedded Gitleaks default rules (222 in the current build), covering cloud credentials, source control tokens, AI provider keys, payment keys, and private keys.
- [**Custom Regex**](https://docs.getbifrost.ai/enterprise/guardrails/custom-regex) includes a PII Detection template for email addresses, US phone numbers, US Social Security numbers, credit-card-like numbers, and IPv4 addresses. The template is pattern-based, not semantic, so it does not detect names.
- **Semantic PII detection** comes from integrated providers such as [Microsoft Presidio](https://docs.getbifrost.ai/integrations/guardrails/presidio) and Azure AI Language PII.

Detection is only half the control. Bifrost supports [three redaction modes](https://docs.getbifrost.ai/enterprise/guardrails/redaction): `runtime` rewrites the live request or response, `logs_only` leaves runtime content untouched but redacts Bifrost logs and trace exports, and `runtime_reversible` uses numbered placeholders that a user with the `Logs:Reveal` permission can reverse. Each virtual key can also turn off content logging for its traffic, and [data access control](https://docs.getbifrost.ai/enterprise/data-access-control) limits which logs each person can see.

OWASP's Tier 1 mitigations also include authorizing before retrieval and governing the corpus, and neither happens at the gateway. The [enterprise guide to LLM guardrails at the gateway layer](https://www.getmaxim.ai/articles/llm-guardrails-at-the-gateway-layer-for-enterprise-ai-security/) shows how teams pair these modes with retrieval-side controls.

## Excessive Agency: Limiting What Agents Can Call

Excessive Agency (LLM03) moved to third place in 2026, and it is partially covered at the gateway. For tools reached through MCP, Bifrost enforces OWASP's first mitigations directly: minimize the tools offered, require approval for high-impact actions, and execute in the user's context. Tools called outside the gateway, and permissions inside each tool, stay outside its reach.

OWASP names three root causes, excessive functionality, excessive permissions, and excessive autonomy, and each maps to a gateway control. Bifrost applies tool filtering at three stacked levels: the MCP client's `tools_to_execute` list, an optional per-request header, and the virtual key. Each level can only remove tools.

![MCP tools pass through client allow-lists, request header filters, and virtual key allow-lists before the model sees them, then only auto-execute tools run without approval](https://articles-images-cdn.t3.tigrisfiles.io/diagrams/owasp-llm-top-10/owasp-llm-top-10-tool-narrowing.png)

*Figure 3: Each filter can only remove tools, and anything outside the auto-execute list goes back to the application for approval.*

Each control and the OWASP mitigation it serves:

- **Minimize tools.** [MCP tool filtering per virtual key](https://docs.getbifrost.ai/features/governance/mcp-tools) is deny-by-default: a key with no MCP configuration gets no tools, apart from clients an admin marks Allow by Default, and a caller's header can narrow the allow-list but never widen it.
- **Require approval.** In [Agent Mode](https://docs.getbifrost.ai/mcp/agent-mode), only tools listed in `tools_to_auto_execute` run without approval, and that list is empty by default. Any other tool call is returned to the application.
- **Bound autonomy.** `max_agent_depth` caps the number of agent iterations (default 10), a circuit breaker against tool loops.
- **Execute in the user's context.** [MCP authentication](https://docs.getbifrost.ai/mcp/auth/overview) supports per-user OAuth, per-user headers, and (on Enterprise) token exchange, so tool calls reach upstream servers under the caller's identity, not a shared account.
- **Inspect arguments.** An MCP guardrail rule such as `mcp_client == "github" && mcp_tool == "create_issue"` or `mcp_arguments["amount"] > 1000` can block a call before it executes.

A virtual key create payload that scopes an agent to one model and one read-only tool, with a budget and rate limits, looks like this:

```json
{
  "name": "support-agent",
  "provider_configs": [
    { "provider": "openai", "allowed_models": ["gpt-4o-mini"], "key_ids": ["*"] }
  ],
  "mcp_configs": [
    { "mcp_client_name": "billing-client", "tools_to_execute": ["check-status"] }
  ],
  "budgets": [{ "max_limit": 50.00, "reset_duration": "1M" }],
  "rate_limit": {
    "token_max_limit": 100000, "token_reset_duration": "1h",
    "request_max_limit": 60, "request_reset_duration": "1m"
  }
}
```

The gateway cannot narrow a tool's own implementation: if `check-status` connects to a database with write access, that problem sits in the tool. The guide to [MCP security risks and how to mitigate them](https://www.getmaxim.ai/articles/mcp-security-risks-and-how-to-mitigate-them/) covers server-side hardening, and the [Bifrost MCP gateway post on access control and cost governance](https://www.getmaxim.ai/bifrost/blog/bifrost-mcp-gateway-access-control-cost-governance-and-92-lower-token-costs-at-scale) shows the gateway configuration at scale.

## Unbounded Consumption: Budgets and Rate Limits

Unbounded Consumption (LLM06) is the one risk on the OWASP LLM Top 10 that a gateway covers directly, and it rose four places in 2026. OWASP's listed mitigations (token-aware rate limits, hard spending caps, and agent circuit breakers) are gateway functions, and Bifrost enforces each of them on the request path.

OWASP says request-rate limiting alone is no longer sufficient, and asks that spending caps halt inference when exceeded rather than only send an alert that fast workloads can outrun. Bifrost [budgets and rate limits](https://docs.getbifrost.ai/features/governance/budget-and-limits) work that way.

![A request with a virtual key is checked against provider config limits, virtual key budget and rate limits, team budget, and customer budget before Bifrost calls the provider](https://articles-images-cdn.t3.tigrisfiles.io/diagrams/owasp-llm-top-10/owasp-llm-top-10-budget-checks.png)

*Figure 4: A single exhausted level stops the request, which turns spending caps into enforcement rather than alerts.*

How the controls line up with OWASP's guidance:

- **Hard spending caps.** Budgets apply to provider configs, virtual keys, teams, and customers, and any single exhausted budget blocks the request.
- **Token-aware rate limits.** Request limits and token limits run in parallel at the same four levels, with reset windows from one minute to one year.
- **Agent circuit breakers.** The `max_agent_depth` limit stops runaway tool loops in Agent Mode.
- **Cost attribution.** Costs are deducted from every level in the hierarchy, so spend is visible per key, team, and customer.
- **Alerting.** [Bifrost Enterprise alerting](https://docs.getbifrost.ai/enterprise/alerting/overview) evaluates CEL rules over budgets and rate limits and notifies Slack, Microsoft Teams, PagerDuty, or a webhook.

When a provider config exceeds its limits, that provider is excluded from routing while others on the same key remain available, which serves OWASP's graceful-degradation mitigation. Sandboxing the application's network access remains an infrastructure task. The walkthrough on [LLM API rate limiting with virtual keys and budgets](https://www.getmaxim.ai/articles/llm-api-rate-limiting-with-virtual-keys-and-budgets/) covers configuration patterns.

## Output Risks: Misinformation and Improper Output Handling

Misinformation (LLM07) mostly needs controls outside the gateway, and Improper Output Handling (LLM10) is partially covered. Bifrost can screen responses and tool arguments, but the decisive controls, grounding claims before action and encoding output for its destination, live in the consuming application.

### LLM07:2026 Misinformation

OWASP flags Misinformation as the widest gap between vote and evidence: practitioners ranked it low, incidents placed it near the top. Its mitigations (grounding, claim-check-act patterns, runtime verification for high-impact actions) are application workflow decisions.

The gateway contributes two narrower checks. Patronus AI, one of the integrated [guardrail providers](https://docs.getbifrost.ai/enterprise/guardrails), offers hallucination detection on responses. Prompt Guardrails can block claim types an organization forbids, such as definitive medical diagnoses. Neither verifies that an answer is correct, so the rating stays at "needs controls elsewhere."

### LLM10:2026 Improper Output Handling

Improper Output Handling fell from fifth to tenth, but model output passed unvalidated to a browser, shell, or database can still produce XSS, SSRF, or remote code execution. OWASP's fix is to treat the model as an untrusted user, with context-aware encoding and parameterized queries.

Bifrost covers part of this. Output guardrail rules can block or redact responses that match known patterns, and Custom Regex can reject organization-specific strings. For agents, MCP input guardrails inspect the arguments a model generates before the tool executes, which is where output turns into an action. Encoding output for an HTML page or a SQL statement happens in the code that renders it.

## LLM Security Risks That Need Controls Outside the Gateway

Three OWASP LLM Top 10 risks sit mostly outside the gateway path: Supply Chain (LLM04), Data and Model Poisoning (LLM05), and Vector and Embedding Weaknesses (LLM09). They concern how models are built and how retrieval indexes are populated, which a gateway does not see.

### LLM04:2026 Supply Chain

OWASP's Supply Chain entry covers third-party models, datasets, LoRA adapters, and conversion pipelines. The gateway's contribution is access control: a Bifrost virtual key is deny-by-default for providers and can restrict each provider to an `allowed_models` list, so applications can only reach models the platform team has approved.

The gateway itself is also part of the supply chain. Bifrost runs [dependency scanning, static analysis, container scanning, and SHA-pinned GitHub Actions](https://docs.getbifrost.ai/security) on its own repositories and ships production images on a FIPS 140-2 validated base. Model provenance and artifact signing for the models a team deploys remain build-pipeline work.

### LLM05:2026 Data and Model Poisoning

Poisoning targets pre-training, fine-tuning, and embedding data, none of which passes through an inference gateway. Bifrost [request logs](https://docs.getbifrost.ai/features/observability/default) capture inputs, outputs, tokens, cost, and latency per request, which supports reviewing model behavior after a change, but detecting poisoned data belongs in the data pipeline.

### LLM09:2026 Vector and Embedding Weaknesses

OWASP names semantic caches alongside RAG and agent memory as part of the embedding trust boundary, and that includes the gateway's own cache. [Bifrost semantic caching](https://docs.getbifrost.ai/features/semantic-caching) only engages when a request carries a cache key (or a configured default key applies), and by default an entry is served only to the identity that wrote it (the same virtual key and user). Keeping that identity scoping on prevents one tenant from receiving another tenant's cached answer.

The main LLM09 controls, enforcing tenant scoping inside the index query and validating content at ingest, belong to whoever owns the vector store. The [practical guide to AI security risks for engineering teams](https://www.getmaxim.ai/articles/ai-security-risks-a-practical-guide-for-engineering-teams/) covers retrieval-layer controls.

## Applying the OWASP Top 10 for LLMs in Production

Teams applying the OWASP Top 10 for LLMs at the gateway get the most coverage fastest by enforcing identity first, then spending limits, then tool scoping, then content guardrails. Budgets, tool allow-lists, and guardrail rules all attach to the identity a request presents, so identity comes first.

A practical order of operations:

1. **Make virtual keys mandatory.** Enable enforced authentication on inference so no request bypasses governance, and issue keys per application, team, or user.
2. **Set budgets and token limits.** Put hard caps on every key and team before expanding access; this addresses LLM06 first.
3. **Scope MCP tools.** Start from deny-by-default, grant the minimum tools per key, and keep `tools_to_auto_execute` empty for anything with side effects.
4. **Add guardrail rules.** Begin with Secrets Detection and the PII template on input and output, then add a prompt-injection provider on user prompts and MCP tool results.
5. **Decide what gets logged.** Choose a redaction mode, set per-key content logging, and use role-based access control to limit who can reveal redacted values.

Auditors will ask for evidence that these controls stayed in place. [Bifrost audit logs](https://docs.getbifrost.ai/enterprise/audit-logs) record administrative activity, such as edits to keys, rules, and settings, with optional HMAC signing, configurable retention, and export as JSON, JSON Lines, or Syslog. The guide to [AI audit trail controls for LLM traffic](https://www.getmaxim.ai/articles/ai-audit-trail-controls-and-audit-logs-for-llm-traffic/) explains how request logs and audit logs fit together.

Gateway coverage only applies to traffic that reaches the gateway. For AI usage on employee machines, the AI Gateway + Bifrost Edge pairing keeps the gateway as the policy engine while [Bifrost Edge](https://docs.getbifrost.ai/edge/overview), currently in alpha, routes desktop apps, browser AI, and coding agents through it. Regulated teams can run the whole stack in their own network with [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) and in-VPC deployment, and the [Bifrost governance resource page](https://www.getmaxim.ai/bifrost/resources/governance) collects the related controls in one place.

## Frequently Asked Questions

### What are the top 10 AI vulnerabilities according to OWASP?

The OWASP Top 10 for LLM Applications 2026 lists Prompt Injection, Sensitive Information Disclosure, Excessive Agency, Supply Chain, Data and Model Poisoning, Unbounded Consumption, Misinformation, Hidden Context Exposure, Vector and Embedding Weaknesses, and Improper Output Handling, numbered LLM01 through LLM10. Agentic risks are covered in OWASP's separate Top 10 for Agentic Applications.

### What changed in the OWASP LLM Top 10 for 2026?

The 2026 edition weighs the community vote against 6,639 classified real-world incidents. Excessive Agency rose to third, Unbounded Consumption rose four places to sixth, and Improper Output Handling fell from fifth to tenth. System Prompt Leakage became Hidden Context Exposure, and Prompt Injection now covers cross-modal attacks hidden in images or audio.

### Is the OWASP Top 10 still relevant?

Yes. The OWASP Top 10 for LLM Applications gives teams a shared vocabulary for LLM security reviews, threat models, and audits, and the 2026 edition maps its risks to NIST, MITRE ATLAS, and CWE. It is a prioritization guide, not a compliance standard.

### What is the OWASP Top 10 list?

OWASP publishes several Top 10 lists. The original OWASP Top 10 ranks web application security risks. The OWASP Top 10 for LLM Applications, maintained by the OWASP GenAI Security Project, ranks risks specific to software built on large language models. The project also maintains a Top 10 for Agentic Applications for systems where models act through tools and memory.

### Can an AI gateway stop prompt injection?

An AI gateway can reduce prompt injection risk but cannot eliminate it. Bifrost can run [prompt-injection guardrails](https://docs.getbifrost.ai/enterprise/guardrails) on user prompts, tool results, and responses, and block or flag matches. OWASP states that models do not separate instructions from data, so a novel injection may pass detection. Limiting tools and permissions through the gateway contains what a successful injection can do.

### Do AI guardrails replace application security controls?

No. AI guardrails inspect content at the model and tool boundary, which covers part of the OWASP LLM Top 10. Output encoding, parameterized queries, retrieval authorization, training-data provenance, and tool-level permissions still belong in the application and data pipeline. Guardrails are one deterministic layer alongside those controls.

## Cover the OWASP LLM Top 10 with Bifrost

The OWASP LLM Top 10 tells security and platform teams what to defend, and the gateway is where several of those defenses become enforceable. Bifrost covers Unbounded Consumption directly, contains Excessive Agency with deny-by-default tool scoping, and adds guardrails, PII redaction, and secrets detection for injection and disclosure risks. To map your own LLM security controls against the 2026 list, [book a demo](https://getmaxim.ai/bifrost/book-a-demo) with the Bifrost team.

## Read next

[![OpenClaw vs Hermes: Which Agent to Run and How to Control It](https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w720/2026/10/openclaw-vs-hermes-which-agent-to-run-and-how-to-control-it-bifrost-1920x1080.png) OpenClaw and Hermes Agent are open-source, self-hosted AI agents that run on your own hardware and reach you through chat apps. This openclaw vs hermes guide compares how each is built and secured, says which to run for which job, and shows how to cap its models, spend, and MCP tools.](https://www.getmaxim.ai/articles/openclaw-vs-hermes-which-agent-to-run-and-how-to-control-it/)

[![AnythingLLM With Every Model: Connect and Govern It Through One Gateway](https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w720/2026/10/anythingllm-with-every-model-connect-and-govern-it-through-o-bifrost-1920x1080.png) AnythingLLM is an open-source AI application for document chat, agents, and team workspaces. This guide shows how to route AnythingLLM through Bifrost so every workspace reaches any model through one endpoint, with budgets, rate limits, failover, and request logs.](https://www.getmaxim.ai/articles/anythingllm-with-every-model-connect-and-govern-it-through-one-gateway/)

[![Top 5 AI Inventory Tools to Track Every Model and AI App in 2026](https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w720/2026/10/top-5-ai-inventory-tools-to-track-every-model-and-ai-app-in--bifrost-1920x1080.png) An AI inventory is a continuously updated record of every model, provider, AI app, agent, and MCP server an organization uses. This guide compares five AI inventory tools, including Bifrost, Wiz AI-SPM, and ServiceNow AI Control Tower, by coverage, discovery method, and enforcement.](https://www.getmaxim.ai/articles/top-5-ai-inventory-tools-to-track-every-model-and-ai-app-in-2026/)

## More in AI Gateway

[![Top 5 AI Inventory Tools to Track Every Model and AI App in 2026](https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w720/2026/10/top-5-ai-inventory-tools-to-track-every-model-and-ai-app-in--bifrost-1920x1080.png) An AI inventory is a continuously updated record of every model, provider, AI app, agent, and MCP server an organization uses. This guide compares five AI inventory tools, including Bifrost, Wiz AI-SPM, and ServiceNow AI Control Tower, by coverage, discovery method, and enforcement.](https://www.getmaxim.ai/articles/top-5-ai-inventory-tools-to-track-every-model-and-ai-app-in-2026/)

[![AnythingLLM With Every Model: Connect and Govern It Through One Gateway](https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w720/2026/10/anythingllm-with-every-model-connect-and-govern-it-through-o-bifrost-1920x1080.png) AnythingLLM is an open-source AI application for document chat, agents, and team workspaces. This guide shows how to route AnythingLLM through Bifrost so every workspace reaches any model through one endpoint, with budgets, rate limits, failover, and request logs.](https://www.getmaxim.ai/articles/anythingllm-with-every-model-connect-and-govern-it-through-one-gateway/)

```json
{
    "@context": "https://schema.org",
    "@type": "Article",
    "publisher": {
        "@type": "Organization",
        "name": "Maxim Articles",
        "url": "https://www.getmaxim.ai/articles/",
        "logo": {
            "@type": "ImageObject",
            "url": "https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w256h256/2025/08/thumbnail.png",
            "width": 60,
            "height": 60
        }
    },
    "author": {
        "@type": "Person",
        "name": "Kuldeep Paul",
        "image": {
            "@type": "ImageObject",
            "url": "https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/2025/08/1727978381919.jpeg",
            "width": 800,
            "height": 800
        },
        "url": "https://www.getmaxim.ai/articles/author/kuldeep/",
        "sameAs": []
    },
    "headline": "OWASP LLM Top 10: How to Cover Each Risk at the Gateway",
    "url": "https://www.getmaxim.ai/articles/owasp-llm-top-10-how-to-cover-each-risk-at-the-gateway/",
    "datePublished": "2026-10-15T21:29:00.000Z",
    "dateModified": "2026-10-17T21:31:04.000Z",
    "image": {
        "@type": "ImageObject",
        "url": "https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w1200/2026/10/owasp-llm-top-10-how-to-cover-each-risk-at-the-gateway-bifrost-1920x1080.png",
        "width": 1200,
        "height": 675
    },
    "keywords": "AI Gateway",
    "description": "The OWASP LLM Top 10 ranks the ten most critical security risks in applications built on large language models. This guide walks each 2026 risk, from prompt injection to unbounded consumption, and shows what an AI gateway such as Bifrost can enforce and where other controls are required.\n",
    "mainEntityOfPage": "https://www.getmaxim.ai/articles/owasp-llm-top-10-how-to-cover-each-risk-at-the-gateway/"
}
```