| LLM01:2026 Prompt Injection | Content from any channel, including users, retrieved documents, tool output, media or persistent memory, alters model behavior because instructions and data share one token stream. | LLM01:2025 | 4 |
| LLM02:2026 Sensitive Information Disclosure | Confidential or regulated data leaks through answers, tool arguments, logs, embeddings or measurable side channels, at training, inference, pipeline or observation time. | LLM02:2025 | 3 |
| LLM03:2026 Excessive Agency | An LLM-based system can take damaging actions because its tools carry excessive functionality, permissions or autonomy when the model errs or is manipulated. | LLM06:2025 | 3 |
| LLM04:2026 Supply Chain | Third-party models, adapters, datasets, conversion or merge pipelines and deployment platforms are tampered with, misrepresented or vulnerable. | LLM03:2025 | 1 |
| LLM05:2026 Data and Model Poisoning | Pre-training, fine-tuning, embedding or other ingested data, or the model artifacts themselves, are manipulated to embed backdoors, bias or harmful behavior. | LLM04:2025 | 1 |
| LLM06:2026 Unbounded Consumption | Uncontrolled inference and the downstream work it triggers let attackers exhaust capacity, run up costs (denial of wallet) or clone a model. | LLM10:2025 | 2 |
| LLM07:2026 Misinformation | Plausible but wrong, incomplete or unsupported output is trusted and then drives a human decision, an automated workflow or an agent action. | LLM09:2025 | 4 |
| LLM08:2026 Hidden Context Exposure | System prompts, developer instructions, tool schemas and other hidden context are extracted or inferred; impact grows when that context holds secrets or is relied on as a control. | LLM07:2025 | 2 |
| LLM09:2026 Vector and Embedding Weaknesses | Embedding and similarity-search layers (RAG, vector memory, semantic caches) are abused through poisoning, inversion, retrieval jamming or access-control failures such as cross-tenant leakage. | LLM08:2025 | 1 |
| LLM10:2026 Improper Output Handling | Model output reaches browsers, shells, databases, renderers or other components without validation or encoding, enabling XSS, SSRF, code execution or data exfiltration. | LLM05:2025 | 4 |