OWASP Evolution

MisinformationLLM07: Misinformation · 2026

Incorrect or manipulated information becomes a vulnerability when a person, workflow or agent accepts it as true and acts on it.

Summary

Incorrect or manipulated information becomes a vulnerability when a person, workflow or agent accepts it as true and acts on it.

How the attack works

LLM07 · How the attack worksThe model invents a convincing reference; a person accepts the answer without checking its source and makes a wrong decision.QuestionModelInvented citationDecisionWithout source checking

The model invents a convincing reference; a person accepts the answer without checking its source and makes a wrong decision.

Example

Vulnerable · Pseudocode
Prompt: What is our return deadline?
Answer: 90 days, per policy section 8.
# No such section exists

Fix: Ground answers in verifiable sources, check citations and require human review for important decisions.

Prevention

  • Use authoritative, current sources.
  • Separate generation, verification and execution.
  • Check authorization, preconditions and state before acting.

Lineage

  1. 2025 · LLM09: Misinformation Moves up to rank 7 in 2026
  2. 2026 · LLM07: Misinformation Moves up from rank 9
  • 2025:LLM09 → 2026:LLM07: Misinformation moves up from rank 9 to 7.

Sources

Buy me a coffee

OWASP Evolution

Editions
Continues / movesContinues RenamedRenamed Merged / expandedMerged