Module 15 is built on the 2025 LLM Top 10 -> the 2026 edition supersedes it

Hi,

The OWASP GenAI LLM Top 10 2026 was published on 4 August 2026. Module 15 is built on the 2025 list throughout, so 15.00 and 15.01 are a version behind.

genai.owasp.org/llm-top-10/ still presents the 2025 list as current. The 2026 edition sits on the resource page and in the project repo. I only caught it because the ranks in 15.01 didn't match what I remembered reading.

What moved

Source: GenAI-Security-Project/GenAI-LLM-Top10, 2026/final/.

Where it actually bites

15.1 lists the ten 2025 entries under their old numbers

15.7 is a whole section on System Prompt Leakage. The 2026 preface says:

System Prompt Leakage is now Hidden Context Exposure, a broader framework for the same failure to trust information that should have stayed out of reach.

LLM08:2026 tells to treat the system prompt as inherently discoverable and never to rest a security control on its confidentiality. 15.7 currently recommends "Prompt obfuscation techniques", which points in the opposite direction. If a candidate learns the current text, they learn the wrong instinct.

15.13 AI-Generated Code Security already exists but stands on its own. In the 2026 edition that risk is explicitly part of LLM10.

Two scope questions

Should the module scope down? 15.5 (Training Data Poisoning) and 15.6 (Model Theft and Extraction) read as ML engineering to me. A web developer taking a foundation-level certification isn't training models or defending model weights. @ryarmst already raised in #3 that Module 15 might sit beyond the intended scope. I'd cut both back to what a developer consuming somebody else's model needs to recognize.

Should it scope up? That same developer is now wiring tools and MCP servers into applications, and that's ordinary integration work rather than ML work. 15.02 already references the OWASP MCP Top 10 and the MCP Security Cheat Sheet, but 15.01 never mentions MCP anywhere. The gap is already in the repo. The Top 10 for Agentic Applications 2026 and the Agent Control Standard both landed on 1 September. I'd pull agentic and MCP risks into the body of knowledge, kept at the level of recognizing what an agent can do on your behalf and what that means for privileges.

Happy to take the rewrite of 15.00, 15.01 and 15.02 once there's a direction. I've sent a separate PR for the source problems in 15.03, which are independent of all this.

Read the current Module 15 sections 15.00, 15.01, 15.02, 15.05–15.07, and 15.13, then compare their claims and numbering with GenAI-Security-Project/GenAI-LLM-Top10’s 2026/final/ material. Resolve the scope questions about model risks, agentic applications, and MCP before rewriting the affected sections; done means the module reflects the agreed 2026 body of knowledge without teaching obsolete guidance.