OWASP Ranked AI Risks Against Real Incidents, and Agency Jumped

The OWASP Top 10 for LLM applications is the list that auditors cite, vendors map their products to and security teams use to argue for budget. Its 2026 edition changes how it was made. For the first time, the ranking was weighted against a corpus of documented incidents rather than expert opinion alone, and the risk that moved most is the one that matters most for the agent era.

The list

The OWASP GenAI Security Project published the 2026 Top 10 on 4 August 2026. The canonical repository gives the order: Prompt Injection, Sensitive Information Disclosure, Excessive Agency, Supply Chain, Data and Model Poisoning, Unbounded Consumption, Misinformation, Hidden Context Exposure, Vector and Embedding Weaknesses, and Improper Output Handling. Against the 2025 edition, per the Cloud Security Alliance's analysis, Excessive Agency rose from sixth to third, Unbounded Consumption from tenth to sixth and Misinformation from ninth to seventh, while Improper Output Handling fell from fifth to tenth, the largest drop. System Prompt Leakage was renamed Hidden Context Exposure.

The evidence

The methodology, as described by the Cloud Security Alliance and by contributor Michael Bargury of Zenity, weighted the ranking roughly 75% on community voting and 25% on incident evidence. The incident work is documented in an arXiv preprint by two working-group members: 7,714 incidents, 6,639 with usable labels, split between 6,297 security incidents drawn from CVE, GitHub Security Advisories and OSV, and 342 AI-harm incidents from the AIAAIC database. The preprint, which states it is not an official OWASP release, finds Prompt Injection and Sensitive Information Disclosure as a clear top tier, Excessive Agency, Supply Chain and Data and Model Poisoning as a middle band with overlapping intervals, and the remaining four reaching the top five in fewer than one draw in twenty.

Steve Wilson, who founded the Top 10 project and sits on the OWASP GenAI board, said the 2026 edition tests community expertise 'against thousands of real-world incidents' and that security 'must evolve with it, assuming AI will sometimes fail or be fooled and putting enforceable controls around what these systems can access, decide and do'.

The Agent Control Standard

The controls Wilson describes now have a specification. OWASP's Agent Control Standard, published on 1 September, 'defines how agent platforms expose middleware hooks and how safety policies can be enforced through them, enabling declarative controls that are portable across agent frameworks and enforced at runtime'. It succeeds the Agent Observability Standard co-created at Zenity, and, per the Cloud Security Alliance, its first version defines an agent bill of materials and tracing based on OpenTelemetry and OCSF. A cross-walk mapping OWASP's GenAI guidance to other frameworks was published the same day, and the Top 10 itself ships with mappings to NIST, MITRE ATLAS, CWE and OWASP's Top 10 for Agentic Applications.

Who benefits, who is at risk

Beneficiaries: security teams that need an evidence-backed baseline to justify agent governance; vendors of runtime guardrails and identity, whose category now has a standard to implement. At risk: organisations whose controls were built to the 2025 ordering, with Improper Output Handling near the top and agency near the bottom, which is the opposite of what the incident data shows.