Migrate crosswalk to OWASP Top 10 for LLM Applications 2026

.github/ISSUE_TEMPLATE/new_framework.md

@@ -15,14 +15,14 @@
 <!-- Must be freely accessible without payment for core content -->
 
 **Source list(s) to map:**
-- [ ] LLM Top 10 2025 (LLM01–LLM10)
+- [ ] LLM Top 10 2026 (LLM01–LLM10)
 - [ ] Agentic Top 10 2026 (ASI01–ASI10)
 - [ ] DSGAI 2026 (DSGAI01–DSGAI21)
 
 ## Justification
 
 **Why does this framework matter for GenAI security practitioners?**
 <!-- 2–3 sentences: who uses this framework and what decision does the mapping enable? -->
 
 **Is this framework used in a regulated sector or jurisdiction?**
 <!-- e.g., EU, US federal, healthcare, finance, OT/ICS -->
@@ -36,11 +36,11 @@
 <!-- e.g., all 10 LLM entries, ~15 of 21 DSGAI entries -->
 
 **Are you willing to write the mapping file(s)?**
 - [ ] Yes — I will submit a PR
 - [ ] Partial — I can draft but need review
 - [ ] No — proposing for community to pick up
 
 ## Conflict of interest
 
 **Are you affiliated with the framework body or a vendor that benefits from this mapping?**
 <!-- Disclosure required per GOVERNANCE.md; does not disqualify the proposal -->

.github/workflows/validate.yml

@@ -63,7 +63,9 @@ jobs:
           TOTAL=$((LLM + AGT + DSG))
           echo "LLM: $LLM  Agentic: $AGT  DSGAI: $DSG  Total: $TOTAL"
 
-          BADGE=$(grep -o 'mapping%20files-[0-9]*-brightgreen' README.md | grep -o '[0-9]*')
+          # Anchor on the '-<count>-' segment: a bare [0-9]* also matches
+          # the '20' inside the URL-encoded '%20'.
+          BADGE=$(grep -o 'mapping%20files-[0-9]*-brightgreen' README.md | sed 's/.*files-\([0-9]*\)-.*/\1/')
           echo "README badge: $BADGE"
 
           if [ "$TOTAL" != "$BADGE" ]; then

CHANGELOG.md

@@ -13,6 +13,58 @@ Next: npm publish to npmjs.com, custom domain (crosswalk.owasp.org), vendor inte
 
 ---
 
+## [4.0.0] — 2026-08-28
+
+Migration to the **OWASP Top 10 for LLM Applications 2026**. This is a breaking
+change for anyone consuming LLM entry IDs: eight of the ten entries changed
+number, and the change is a permutation, so a naive in-order find-and-replace
+will corrupt references. See [MIGRATION.md](MIGRATION.md) for the full map.
+
+### Changed
+
+#### LLM Top 10 retargeted to the 2026 list
+- `source_list` is now `LLM-Top10-2026` (was `LLM-Top10-2025`) across all ten LLM entries
+- Crosswalk version bumped to `2026-Q3`
+- Entries renumbered: `LLM03→LLM04 · LLM04→LLM05 · LLM05→LLM10 · LLM06→LLM03 · LLM07→LLM08 · LLM08→LLM09 · LLM09→LLM07 · LLM10→LLM06`; LLM01 and LLM02 are unchanged
+- All 23 `llm-top10/` framework files renumbered, reordered, and re-titled, with quick-reference tables, audience tags, and cross-references updated
+- Cross-references to LLM entries updated throughout `agentic-top10/`, `dsgai-2026/`, `shared/`, `evals/`, `i18n/`, and the web app
+
+#### Entries renamed and re-scoped
+- **LLM08 Hidden Context Exposure** (was LLM07 System Prompt Leakage) — widened from the system prompt to all non-user-facing context: developer instructions, retrieved policy text, and tool and function schemas
+- **LLM10 Improper Output Handling** (was LLM05 Insecure Output Handling) — widened to cover insecure code generated by coding assistants at scale
+- **LLM04 Supply Chain** (was LLM03 Supply Chain Vulnerabilities) — renamed to match the 2026 title
+- **LLM01 Prompt Injection** — scope note added for cross-modal payloads hidden in image, audio, and video content
+- **LLM05 Data and Model Poisoning** — scope note added for fine-tuning subversion via adapters, customer fine-tunes, and distilled checkpoints
+
+#### Severity re-baselining
+- **LLM03 Excessive Agency** — High → **Critical** (climbed to third, the largest move on the 2026 list)
+- **LLM06 Unbounded Consumption** — Medium → **High** (rose four places)
+- **LLM07 Misinformation** — Medium → **High** (widest vote-versus-evidence gap in the 2026 incident corpus)
+- Rationale recorded in [RATIONALE.md § 4.5](RATIONALE.md)
+
+#### Eval profiles renumbered
+- `evals/garak/` profiles renamed to the 2026 numbering: `LLM03_supply_chain` → `LLM04_supply_chain`, `LLM04_data_poisoning` → `LLM05_data_poisoning`, `LLM05_output_handling` → `LLM10_output_handling`, `LLM07_system_prompt_leakage` → `LLM08_hidden_context_exposure`, `LLM08_embeddings` → `LLM09_embeddings`, `LLM09_misinformation` → `LLM07_misinformation`, `LLM10_resource_exhaustion` → `LLM06_resource_exhaustion`
+- `evals/ci/github-action.yml` and `evals/garak/run_all.sh` updated to the new paths
+
+### Fixed
+
+#### Stale pre-2025 entries in three framework files
+`LLM_DORA.md`, `LLM_FedRAMP.md`, and `LLM_SP800218A.md` still carried entries
+from the **2023** list that earlier updates had missed:
+- Removed the duplicate `Model DoS` entry from each, which shadowed `Unbounded Consumption`
+- Folded `Training Data Poisoning` into LLM05 Data and Model Poisoning
+- Authored the missing LLM10 Improper Output Handling entry for DORA and FedRAMP
+- Authored the missing LLM02 Sensitive Information Disclosure entry for SP 800-218A
+- Their quick-reference tables were keyed to pre-2025 numbering; each file was remapped by entry name rather than by ID
+
+### Added
+
+- `MIGRATION.md` — 2025 → 2026 entry map, scope changes, severity basis, and a checklist for downstream consumers
+- `RATIONALE.md § 4.5` — evidence basis for each severity change
+- A 2026 migration row in the changelog table of every `llm-top10/` framework file
+
+---
+
 ## [3.1.0] — 2026-04-10
 
 ### Added

CROSSREF.md

@@ -1,30 +1,30 @@
 # OWASP GenAI Crosswalk — Master Cross-Reference
 
 This is the single navigation index across all three OWASP GenAI source lists.
-Read left to right: an LLM vulnerability ? its agentic amplification ? its data security dimension.
+Read left to right: an LLM vulnerability → its agentic amplification → its data security dimension.
 
 > **How to use:** Find the risk you care about in any column, then follow the row to see how it surfaces in the other lists and which framework files cover it.
 
 ---
 
 ## Cross-reference table
 
-| LLM Top 10 2025 | Agentic Top 10 2026 | DSGAI 2026 | Primary frameworks |
+| LLM Top 10 2026 | Agentic Top 10 2026 | DSGAI 2026 | Primary frameworks |
 |---|---|---|---|
 | LLM01 Prompt Injection | ASI01 Agent Goal Hijack | DSGAI01 Sensitive Data Leakage | MITRE ATLAS · AIUC-1 B001/B005 · NIST AI RMF · ASVS |
 | LLM01 Prompt Injection | ASI02 Tool Misuse | DSGAI12 Unsafe NL Data Gateways | MITRE ATLAS · AIUC-1 B006 · ISA 62443 · STRIDE |
-| LLM02 Sensitive Info Disclosure | ASI03 Identity & Privilege Abuse | DSGAI01 Sensitive Data Leakage | ISO 27001 · ISO 27701 · AIUC-1 A · SOC 2 · PCIDSS |
-| LLM02 Sensitive Info Disclosure | ASI03 Identity & Privilege Abuse | DSGAI02 Agent Identity & Credential Exposure | OWASP NHI · AIUC-1 B007 · NIST CSF 2.0 · ISO 27001 |
-| LLM03 Supply Chain | ASI04 Agentic Supply Chain | DSGAI04 Data Model & Artifact Poisoning | CycloneDX ML SBOM · NIST SP 800-218A · BSIMM · SAMM |
-| LLM04 Data & Model Poisoning | ASI06 Memory & Context Poisoning | DSGAI04 Data Model & Artifact Poisoning | MITRE ATLAS · AIUC-1 A · CIS Controls · AITG |
-| LLM04 Data & Model Poisoning | ASI06 Memory & Context Poisoning | DSGAI21 Disinformation via Data Poisoning | MITRE ATT&CK · STRIDE · ENISA · EU AI Act |
-| LLM05 Insecure Output Handling | ASI02 Tool Misuse | DSGAI05 Data Integrity & Validation Failures | ASVS · CIS Controls · NIST CSF 2.0 · AIUC-1 B009 |
-| LLM06 Excessive Agency | ASI01 Agent Goal Hijack | DSGAI06 Tool Plugin & Agent Data Exchange | AIUC-1 B006 · ISA 62443 · NIST AI RMF · COBIT |
-| LLM06 Excessive Agency | ASI10 Rogue Agents | DSGAI16 Endpoint & Browser Overreach | AIUC-1 C · MITRE ATLAS · STRIDE · EU AI Act |
-| LLM07 System Prompt Leakage | ASI01 Agent Goal Hijack | DSGAI15 Over-Broad Context Windows | AIUC-1 B003/B009 · ISO 27001 · CIS Controls · ASVS |
-| LLM08 Vector & Embedding Weaknesses | ASI06 Memory & Context Poisoning | DSGAI13 Vector Store Platform Security | MITRE ATLAS · AIUC-1 A · NIST AI RMF · CWE/CVE |
-| LLM09 Misinformation | ASI09 Human-Agent Trust Exploitation | DSGAI21 Disinformation via Data Poisoning | AIUC-1 C/F · EU AI Act · ENISA · NIST AI RMF |
-| LLM10 Unbounded Consumption | ASI08 Cascading Failures | DSGAI17 Data Availability & Resilience Failures | AIUC-1 D · ISA 62443 · NIST SP 800-82 · CIS Controls |
+| LLM02 Sensitive Information Disclosure | ASI03 Identity & Privilege Abuse | DSGAI01 Sensitive Data Leakage | ISO 27001 · ISO 27701 · AIUC-1 A · SOC 2 · PCIDSS |
+| LLM02 Sensitive Information Disclosure | ASI03 Identity & Privilege Abuse | DSGAI02 Agent Identity & Credential Exposure | OWASP NHI · AIUC-1 B007 · NIST CSF 2.0 · ISO 27001 |
+| LLM03 Excessive Agency | ASI01 Agent Goal Hijack | DSGAI06 Tool Plugin & Agent Data Exchange | AIUC-1 B006 · ISA 62443 · NIST AI RMF · COBIT |
+| LLM03 Excessive Agency | ASI10 Rogue Agents | DSGAI16 Endpoint & Browser Overreach | AIUC-1 C · MITRE ATLAS · STRIDE · EU AI Act |
+| LLM04 Supply Chain | ASI04 Agentic Supply Chain | DSGAI04 Data Model & Artifact Poisoning | CycloneDX ML SBOM · NIST SP 800-218A · BSIMM · SAMM |
+| LLM05 Data and Model Poisoning | ASI06 Memory & Context Poisoning | DSGAI04 Data Model & Artifact Poisoning | MITRE ATLAS · AIUC-1 A · CIS Controls · AITG |
+| LLM05 Data and Model Poisoning | ASI06 Memory & Context Poisoning | DSGAI21 Disinformation via Data Poisoning | MITRE ATT&CK · STRIDE · ENISA · EU AI Act |
+| LLM06 Unbounded Consumption | ASI08 Cascading Failures | DSGAI17 Data Availability & Resilience Failures | AIUC-1 D · ISA 62443 · NIST SP 800-82 · CIS Controls |
+| LLM07 Misinformation | ASI09 Human-Agent Trust Exploitation | DSGAI21 Disinformation via Data Poisoning | AIUC-1 C/F · EU AI Act · ENISA · NIST AI RMF |
+| LLM08 Hidden Context Exposure | ASI01 Agent Goal Hijack | DSGAI15 Over-Broad Context Windows | AIUC-1 B003/B009 · ISO 27001 · CIS Controls · ASVS |
+| LLM09 Vector and Embedding Weaknesses | ASI06 Memory & Context Poisoning | DSGAI13 Vector Store Platform Security | MITRE ATLAS · AIUC-1 A · NIST AI RMF · CWE/CVE |
+| LLM10 Improper Output Handling | ASI02 Tool Misuse | DSGAI05 Data Integrity & Validation Failures | ASVS · CIS Controls · NIST CSF 2.0 · AIUC-1 B009 |
 | — | ASI05 Unexpected Code Execution | DSGAI12 Unsafe NL Data Gateways | MITRE ATT&CK · AIUC-1 B006 · ASVS · CWE/CVE |
 | — | ASI07 Insecure Inter-Agent Comms | DSGAI02 Agent Identity & Credential Exposure | OWASP NHI · AIUC-1 E · ISA 62443 · ISO 27001 |
 | — | — | DSGAI03 Shadow AI & Unsanctioned Data Flows | COBIT · ISO 27001 · ENISA · CIS Controls |
@@ -47,7 +47,7 @@ For OT environments, these entries carry the highest blast radius:
 | Risk | Why it matters in OT | Primary OT frameworks |
 |---|---|---|
 | LLM01 / ASI01 | NL-to-SCADA interfaces make prompt injection a process disruption risk | ISA/IEC 62443 · NIST SP 800-82 |
-| LLM10 / ASI08 | Cascading failures in OT can affect physical safety systems | ISA/IEC 62443 SR 7.1 · NIST SP 800-82 |
+| LLM06 / ASI08 | Cascading failures in OT can affect physical safety systems | ISA/IEC 62443 SR 7.1 · NIST SP 800-82 |
 | ASI02 Tool Misuse | AI agents with OT tool access can trigger physical actions | ISA/IEC 62443 · NIST SP 800-82 |
 | DSGAI12 | LLM-to-SQL/historian gateways in OT expose process data | ISA/IEC 62443 · NIST SP 800-82 |
 | DSGAI17 | RAG failures in OT AI affect real-time operational decisions | ISA/IEC 62443 SR 7.6 · NIST SP 800-82 |

MIGRATION.md

@@ -0,0 +1,130 @@
+<!--
+  OWASP GenAI Crosswalk
+  File    : MIGRATION.md
+  Purpose : LLM Top 10 2025 → 2026 entry map and what changed in this crosswalk
+  Version : 2026-Q3
+  License : CC BY-SA 4.0
+-->
+
+# LLM Top 10 — 2025 → 2026 Migration
+
+The crosswalk's `llm-top10/` mappings now target the
+[OWASP Top 10 for LLM Applications 2026](https://genai.owasp.org/llm-top-10/).
+Every entry kept its subject matter, but eight of the ten changed number and two
+changed name and scope. This file is the map: use it to rewrite references in
+your own policies, findings, dashboards, and CI configuration.
+
+> **Nothing here changes the Agentic Top 10 (ASI) or DSGAI 2026 entries.** Their
+> IDs are unchanged; only their cross-references to LLM entries were renumbered.
+
+---
+
+## Entry map
+
+| 2025 ID | 2025 name | → | 2026 ID | 2026 name | Movement |
+|---|---|:--:|---|---|---|
+| LLM01 | Prompt Injection | → | **LLM01** | Prompt Injection | Steady |
+| LLM02 | Sensitive Information Disclosure | → | **LLM02** | Sensitive Information Disclosure | Steady |
+| LLM06 | Excessive Agency | → | **LLM03** | Excessive Agency | ▲ 3 places |
+| LLM03 | Supply Chain Vulnerabilities | → | **LLM04** | Supply Chain | ▼ 1 place, renamed |
+| LLM04 | Data and Model Poisoning | → | **LLM05** | Data and Model Poisoning | ▼ 1 place |
+| LLM10 | Unbounded Consumption | → | **LLM06** | Unbounded Consumption | ▲ 4 places |
+| LLM09 | Misinformation | → | **LLM07** | Misinformation | ▲ 2 places |
+| LLM07 | System Prompt Leakage | → | **LLM08** | Hidden Context Exposure | ▼ 1 place, re-scoped |
+| LLM08 | Vector and Embedding Weaknesses | → | **LLM09** | Vector and Embedding Weaknesses | ▼ 1 place |
+| LLM05 | Insecure Output Handling | → | **LLM10** | Improper Output Handling | ▼ 5 places, renamed |
+
+### Reverse lookup
+
+`LLM01→LLM01 · LLM02→LLM02 · LLM03→LLM04 · LLM04→LLM05 · LLM05→LLM10 ·
+LLM06→LLM03 · LLM07→LLM08 · LLM08→LLM09 · LLM09→LLM07 · LLM10→LLM06`
+
+---
+
+## Entries that changed scope
+
+### LLM08 — System Prompt Leakage → Hidden Context Exposure
+
+The broadest change on the list. The 2026 entry covers the extraction,
+inference, or reconstruction of **any** non-user-facing context the application
+assembles into the model's context window — the system prompt, developer
+instructions, retrieved policy text, and the tool and function schemas exposed
+to the model — not just the system prompt.
+
+Severity tracks what that context holds: internal rules and workflow logic are
+medium, embedded credentials or reliance on context secrecy for authorisation
+are high, and disclosure that chains to code execution or broad exfiltration is
+critical. The design principle is that hidden context is discoverable and is
+never a security boundary.
+
+### LLM10 — Insecure Output Handling → Improper Output Handling
+
+Renamed, and widened to cover the insecure code that coding assistants generate
+at scale. Output that reaches a compiler, a repository, or a production system
+carries the same downstream-execution risk as output that reaches a shell, a
+browser, or a database.
+
+### Entries that grew without changing name
+
+| Entry | Absorbed in 2026 |
+|---|---|
+| **LLM01** Prompt Injection | Cross-modal attacks — instructions hidden in image, audio, or video content |
+| **LLM04** Supply Chain | Artifact provenance — unsigned weights, hijacked conversion/merge services, model namespace reuse |
+| **LLM05** Data and Model Poisoning | Fine-tuning subversion — backdoored adapters, customer fine-tunes, distilled checkpoints |
+| **LLM10** Improper Output Handling | Insecure generated code reaching compilers, repositories, and production |
+
+---
+
+## Severity re-baselining
+
+Three entries moved severity. Each change follows the rank movement the 2026
+list published, and its rationale in the OWASP project leads' preface. See
+[RATIONALE.md § 4.5](RATIONALE.md#45-2026-severity-re-baselining) for the full
+justification.
+
+| Entry | 2025 | 2026 | Basis |
+|---|---|---|---|
+| **LLM03** Excessive Agency | High | **Critical** | Climbed to third, the largest move on the list; vote and incident record agree that agentic deployments are where damage lands |
+| **LLM06** Unbounded Consumption | Medium | **High** | Rose four places on practitioner weighting of resource and cost exhaustion |
+| **LLM07** Misinformation | Medium | **High** | Widest vote-versus-evidence gap on the list, with the incident record placing it near the top |
+
+The other seven entries kept their 2025 severity.
+
+---
+
+## What to update on your side
+
+1. **Findings and risk registers** — rewrite entry IDs using the map above. Eight
+   of ten change, and five of the changes are a permutation, so a naive
+   find-and-replace run in ID order will corrupt them. Substitute all IDs in one
+   pass, or map by entry name.
+2. **CI eval configuration** — the garak profiles under `evals/garak/` were
+   renamed to the 2026 numbering. See the table in [evals/README.md](evals/README.md).
+3. **Dashboards and queries** — `source_list` in `data/entries/*.json` is now
+   `LLM-Top10-2026`. Anything filtering on `LLM-Top10-2025` returns nothing.
+4. **Scope boundary** — the 2026 list draws a sharper line: it owns the risk
+   while the model is a component inside your application. Once the model
+   becomes an actor, with tools it can call and memory it carries between
+   sessions, pair the entry with the
+   [OWASP Agentic Top 10](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/).
+
+---
+
+## Corrections made during the migration
+
+Three framework files carried entries from the **2023** list that earlier
+updates had missed. They were reconciled to the 2026 list as part of this work:
+
+| File | Problem | Resolution |
+|---|---|---|
+| `llm-top10/LLM_DORA.md` | Carried both `Model DoS` (2023) and `Unbounded Consumption`; `Training Data Poisoning` (2023) in place of `Data and Model Poisoning`; no output-handling entry | Dropped the stale `Model DoS` duplicate, folded `Training Data Poisoning` into LLM05, authored LLM10 |
+| `llm-top10/LLM_FedRAMP.md` | Same three problems | Same resolution |
+| `llm-top10/LLM_SP800218A.md` | Same duplication, plus no `Sensitive Information Disclosure` entry | Dropped the stale duplicate, folded `Training Data Poisoning` into LLM05, authored LLM02 |
+
+Their quick-reference tables were keyed to the pre-2025 numbering, so each file
+was remapped by entry **name** rather than by ID.
+
+---
+
+*Part of the [OWASP GenAI Crosswalk](https://github.com/GenAI-Security-Project/crosswalk) —
+maintained by the [OWASP GenAI Data Security Initiative](https://genai.owasp.org)*