Skip to content
Guard0

The 2026 OWASP LLM Top 10 Accidentally Told On All of Us

· 7 min read · Kanav Tikone

The 2026 OWASP LLM Top 10 Accidentally Told On All of Us

Every security list ever published has the same quiet flaw: it ranks what practitioners worry about, not what actually happens. The 2026 OWASP Top 10 for LLM Applications is the first edition that tried to fix this, and in doing so it exposed something far more interesting than the ranking itself.

This year, OWASP didn't just poll hundreds of AI security experts. It assembled a corpus of 7,714 AI-related security incidents from public vulnerability databases and AI-harm repositories, filtered it down to 6,639 classifiable cases, and blended that incident data (25% weight) with community votes (75% weight) to produce the final ranking. The appetite for the result speaks for itself: the 2026 edition crossed 10,000 downloads within 48 hours of its early-August release.

Then the data and the experts disagreed. Loudly. And that disagreement is the most honest thing an industry framework has given us in years.

First, the list itself

For the record, the 2026 ranking: Prompt Injection and Sensitive Information Disclosure hold #1 and #2 for the third consecutive edition. Excessive Agency jumps from sixth to third. Supply Chain, Data and Model Poisoning, and Unbounded Consumption fill the middle. Misinformation climbs to #7. System Prompt Leakage is reborn as the broader Hidden Context Exposure at #8. Vector and Embedding Weaknesses sits at #9, and Improper Output Handling falls from fifth all the way to tenth.

Fine. Now the interesting part.

The prompt injection paradox

Here is the stat that should make everyone uncomfortable: prompt injection, the undisputed #1 by practitioner vote and the risk with its own conference-talk economy, barely registered in the incident data. Across 6,639 classified incidents, it placed twelfth by raw counts. Expert rank: #1. Incident rank: #12. Not even in the top ten of things that demonstrably happen.

OWASP's explanation is what the project calls a defensive bias, or "defense effect": we're so collectively obsessed with prompt injection that we've built enough controls to contain attempts before they become reportable incidents. There's a simpler reason too: prompt injection is the obvious attack surface. It's everywhere a user can type. It's easy to understand, easy to demo, easy to defend budget for. Of course we built defenses there first.

I half buy it. But notice what this explanation does: it makes the ranking unfalsifiable. If incident counts are high, the risk is real. If incident counts are low, the risk is real and our defenses are working. The Cloud Security Alliance's research note on the 2026 edition called this out precisely: a dataset that systematically undercounts well-defended risks undermines the claim that incident data gives us clearer insight. Absence of evidence becomes proof of nothing at all.

And yet prompt injection still deserves the #1 spot, for a reason the incident numbers can't capture: it's not a bug, it's a structural property. As Simon Willison has argued for years, there is no parameterized-query equivalent for LLMs. The model processes the developer's instructions, the user's input, and a poisoned retrieved document through the same mechanism, and it cannot reliably tell them apart. You don't patch that. You architect around it. Low incident counts today say nothing about an unsolved foundation underneath everything else on the list.

Misinformation is the sleeper, and nobody wants to hear it

The mirror-image discrepancy is the one I think deserves the headlines, and it's the widest gap anywhere in the 2026 analysis: misinformation ranked #2 in the incident data and #13 in the expert vote. The practitioners building these systems rank it below the cutoff of the list; the record of what actually goes wrong puts it just behind sensitive information disclosure. An eleven-position disagreement is not noise. It's a blind spot with a measurement attached.

Why the blind spot? I think the mechanism is simple: we've been conditioned to expect hallucination. Every user of generative AI has internalized "it might be wrong sometimes" as a cost of doing business. And that conditioning is exactly what makes poisoning and drift invisible: if you expect some percentage of output to be garbage, you stop investigating why any particular output is garbage. Slow corruption hides inside tolerated noise. Nobody files an incident ticket for a vibe.

Now combine that with the other big mover on the list. An agent that ingests misinformation doesn't just say something wrong. It does something wrong, at machine speed, in perpetuity, with legitimate credentials. The CSA note made the sharp observation that the taxonomy treats Misinformation and Excessive Agency as fully independent risks when they're mechanically linked: a hallucination feeding an unreviewed downstream action is one failure chain, not two categories. The 2026 list ranks the links separately and misses the chain.

Black Hat 2026 supplied the proof of concept. Zenity Labs' "PleaseFix" research demonstrated that a malicious calendar invite, just an invite, could steer an already-authenticated agentic browser into credential theft, data exfiltration, persistence, and code execution, zero clicks required, across multiple flagship agentic browsers. The researchers called the technique intent collision: persuading the agent that what the attacker wants is the best way to accomplish what the user wants. That's not classic prompt injection, where you trick the model into going off-script. It's worse: the agent believes it's still on-script. Misinformation is the exploit. The categories blur in practice precisely where the list keeps them apart.

Excessive Agency at #3 is the industry admitting what it shipped

Excessive Agency jumping three spots is the least surprising and most deserved move. We spent two years racing from AI that generates content to AI that holds credentials, calls tools, authenticates to other systems, and takes actions. The question has shifted from "can I manipulate what the AI says?" to "can I manipulate what the AI does?" Almost everything downstream of that question is about blast radius, not cleverness of the prompt.

Call agents what they really are: privileged accounts. They hold access, they take actions, and by definition they must; that's what makes them useful. Which makes the deployment numbers damning. Kiteworks' 2026 Data Security and Compliance Risk survey (July 2026) found that no AI containment control is deployed by more than 31% of organizations. Not one control in the entire survey has even a third of organizations running it. Meanwhile 80% of organizations experienced at least one security or AI-related incident in the past 12 months, and 65% discovered employees feeding sensitive data into unapproved AI tools.

IBM's Cost of a Data Breach 2026 report completes the picture, and it's worth lining the numbers up:

  • 92% of organizations that suffered an AI-related breach lacked proper access controls on their AI implementations.
  • AI-involved breaches cost an average of $5.33M, versus $4.70M for breaches with no AI involvement, against a record global average of $4.99M (up 12% year over year; $11.5M in the US).
  • Shadow AI showed up in 43% of breached organizations, more than double last year's 20%, with those incidents averaging $5.39M and drawing regulatory fines in roughly one case in five.
  • Meanwhile, only 32% of breached organizations even have an AI policy (down from 37% a year ago), and just 19% coordinate between their AI governance and security teams.

Read those numbers together. Adoption doubled, governance shrank, and the delta shows up directly on the invoice. We didn't under-invest in exotic AI security. We skipped identity basics for a new class of privileged identity, because it didn't look like one. We are in an identity crisis: agents are a weird blend of human and software, and most organizations' access-control muscle memory covers neither half.

The real thesis is buried in the introduction

The best sentence in the 2026 edition isn't a ranking at all. It's the project leads' summary of the whole exercise: the advice to "stop trying to build a model that cannot be fooled," and instead to build the system around the model so that when it is fooled, and it will be, nothing important breaks.

Security people will recognize this instantly: it's resilience and defense-in-depth, re-derived for AI. It's also a quiet concession that five years of alignment tuning, guardrail models, and injection classifiers have not produced, and will not produce, a model that can be trusted as its own security boundary.

The Black Hat agentic-browser research delivered the corollary that I'd frame as the whole game: the controls that actually stopped the attack were the ones the AI never got a vote in. Least privilege. Segmentation. Hard boundaries. Deterministic controls that don't ask the model's opinion. Everything probabilistic (the guardrails, the classifiers, the "please ignore malicious instructions") is friction, not a boundary. Useful friction! But if your last line of defense can be argued with, it isn't a line of defense.

So what do you actually do with the list?

Here's the one thing not to do with it: don't turn the Top 10 into another compliance checklist. Ten checkboxes will get ten checkmarks, and you'll have learned nothing.

Run it as a tabletop instead. Pick any entry and ask three questions:

  1. Could we detect it? If an agent were manipulated tomorrow, would anything fire?
  2. Could we contain it? Can you revoke an agent's access as fast as you'd disable a compromised employee account? Is its blast radius even knowable?
  3. Could we reconstruct it? Do you have the artifacts to determine, after the fact, what the AI actually accessed and did?

Most organizations I've seen would fail all three for most of the ten. That's the real finding of the 2026 edition: not where prompt injection ranks, but that we finally have incident data confirming the gap between what we worry about and what we've operationalized.

The list got more honest this year. The uncomfortable disagreements between the experts and the data aren't a flaw in the methodology. They're the finding. The experts aren't wrong, and neither are the numbers. The experts rank what's possible; the data ranks what's happening; and the distance between the two is exactly the work we haven't done yet.

Sources & further reading

Kanav Tikone
Building the future of AI security at Guard0