OWASP's 2026 Top 10 for LLM Applications still puts prompt injection at number one, exactly where it has sat since the first edition in 2023. What changed this year is the project checked that ranking against a corpus of 7,714 real-world incidents, and by raw incident count alone, prompt injection doesn't crack the top 10 at all. The project kept it at number one anyway, and the reasoning behind that call, published August 3, 2026, tells a funded product team more about where to actually spend security engineering time than the ranking itself does.
What OWASP tested this year, and why it's different
Every prior edition of the OWASP Top 10 for LLM Applications was built the same way: practitioners voted on what worried them most, and the vote became the list. The 2026 edition, published by the OWASP GenAI Security Project, adds a second input for the first time. The project pulled together 7,714 real incidents from public vulnerability databases and an AI-harm database, built classifiers to read them, and sorted the 6,639 that carried enough detail to categorize. Then it asked a direct question, in the project leads' own words: "Does what practitioners fear match what the incident record shows?" Their answer: "no, not always." The final rank blends both inputs, with the practitioner vote holding three-quarters of the weight and the incident record the remaining quarter, a deliberate choice the leads describe as enough to move an entry a tier when belief and evidence diverge sharply, not enough to let one year of imperfect incident data overrule a decade of community judgment on its own.
The gap between what's feared, what's logged, and what actually moved
Prompt injection is the clearest case of the two disagreeing. Practitioners still rank it the top risk, and the incident record, read on its own, doesn't place it in the top 10 at all. OWASP's explanation is a defense effect, not a sign the risk is overblown: teams fight injection hard enough that fewer clean exploits ever reach a public database, so the incident count undercounts a risk that mature teams are already spending real budget holding off. Misinformation runs the opposite direction, and it's the one OWASP's own letter asks readers to slow down on. Practitioners ranked it near the bottom in 2025. The incident record placed it near the top, the widest gap in the direction that actually costs someone money: a model's fluent, confident wrong answer becomes a wrong action once it drives a decision, a tool call, or another agent's next step.
That gap between belief and evidence is also what moved the rest of the list:
| Category | 2025 rank | 2026 rank | Move |
|---|---|---|---|
| Excessive Agency | 6th | 3rd | up 3 |
| Unbounded Consumption | 10th | 6th | up 4 |
| Misinformation | 9th | 7th | up 2 |
| Improper Output Handling | 5th | 10th | down 5 |
Excessive Agency's climb to third is the largest move on the list, and OWASP says both inputs agree on it: agentic deployments are where the damage is actually landing. Misinformation's move, from 9th to 7th, looks modest next to that, and that's the detail worth sitting with. A category the incident data pushed toward the top only moved two spots in the published list, because the vote still carries three times the weight of the evidence. A team using this list as a checklist, in rank order, is following consensus opinion first and the incident record a distant second, on the one category where OWASP itself says that ordering undersells the risk.
Why misinformation gets worse the more autonomous your product gets
OWASP's own description of the misinformation entry names the failure mode plainly: "the core risk is that the incorrect output is trusted and acted upon." In an agentic system, that shows up as incorrect state inference, an agent deciding a condition has been met when it hasn't, or as what OWASP calls cross-agent misinformation propagation, where one agent's wrong output becomes the next agent's trusted input. Neither of those requires an attacker. A model that's simply wrong, running inside a workflow built to act on what it says, produces the same outcome a security incident would. This connects directly to what why your AI agent keeps failing in production already covers from the operational side: the failure mode isn't exotic, it's a wrong answer nobody was checking.
The separate list for when the model can act on its own
OWASP drew a boundary this year that matters for scoping: the LLM Top 10 covers the model as a component inside your application. The moment that model becomes an actor, with tools it can call, memory that persists between sessions, and consequences it sets in motion downstream, the risk moves to a companion document, the OWASP Top 10 for Agentic Applications, published December 9, 2025 with input from more than 100 security practitioners. One control from the LLM Top 10's own agentic guidance is worth quoting directly, because it names the exact condition a product team should check for before shipping: an agent that can "simultaneously access private data, ingest untrusted content, and communicate externally has the conditions for high-impact exploitation, and removing any one leg removes them." If your agent reads a customer's account history, processes an inbound email or ticket, and can send a reply or trigger a refund, all three legs are already in place.
A worked example
Picture a 26-person Series A company that shipped a support agent three months ago. It reads incoming tickets, checks order status in an internal tool, and drafts a refund when it decides a package was never delivered. Nobody red-teamed it for prompt injection, because nobody expected a customer to attack their own support inbox, and on that narrow question they'd be right. What actually breaks it is a tracking API that returns an ambiguous status during a carrier delay, which the model reads as "never delivered" and turns into an approved refund. That's misinformation, not an attack, and it's exactly the incorrect-state-inference pattern OWASP names. The fix isn't a better prompt. It's the same discipline as an evaluation harness built against real edge cases: a golden set that includes ambiguous and delayed carrier statuses, not just clean ones, and a rule that the agent drafts the refund for a human to approve rather than sending it, until the eval set says otherwise.
What to actually prioritize before the sprint plan
Keep building for prompt injection first; OWASP's reasoning for holding it at number one is sound, and the attack surface it opens doesn't close because a raw incident count looks favorable. But budget separate eval time for state-inference correctness anywhere your agent's output triggers a tool call, a refund, an access change, or another agent's next step, since that's the category the incident data says is undersold. Keep credentials and any state-changing capability in application code rather than the model, and route privileged calls through a policy layer that re-checks intent at execution time rather than trusting the model's own account of what it decided. Here's the honest exception: if your product's model output only ever renders to a screen for a person to read, with no tool call, no automated decision, and no downstream agent consuming it, most of this list is precaution rather than urgency. The risk scales with how much unsupervised action a wrong answer can trigger, not with how impressive the feature demo looks.
If you're scoping a support, ops, or internal agent and want a second read on where the incident-count gap actually applies to your architecture before you commit a sprint to it, that's a conversation our Silicon Valley team has with engineering leaders regularly. Tell us what the agent touches and we'll tell you plainly which parts of this list are real for your build and which aren't, the same way our staff-augmentation bench gets scoped before a contract, not after.
Sources
- OWASP GenAI Security Project: OWASP Top 10 for LLM Applications 2026 (published August 3, 2026)
- OWASP Foundation: OWASP Top 10 for LLM Applications 2025 (published November 18, 2024)
- OWASP GenAI Security Project: OWASP Top 10 for Agentic Applications for 2026 (published December 9, 2025)