Author: Mohit Kumar
Part of The Agentic Attack Surface series on securing AI systems, agentic workflows, and the AI software supply chain.
Most people will read the 2026 edition of the OWASP Top 10 for LLM Applications the way they read every Top 10: scan the ranking, note what moved, close the tab.
Do that and you'll miss the actual news. The list didn't just reorder. It changed its own thesis.
The project leads open the 2026 edition with an argument that reads more like a resignation than a security guideline: stop trying to build a model that cannot be fooled. Build the system around it so that when the model is fooled — and it will be — nothing important breaks.
That is not a mitigation. That is a design philosophy, and it is the correct one. It also quietly invalidates about half the AI security tooling being sold right now.
What actually moved
The top two held. Prompt Injection and Sensitive Information Disclosure stayed at one and two, which surprises nobody who has spent ten minutes trying to defend an LLM application.
Below that, the churn was heavier than in previous years, per Help Net Security's breakdown of the release:
Excessive Agency climbed to third. Both the practitioner vote and the incident data agreed that agentic deployments are where the damage is actually landing.
Unbounded Consumption rose four places, driven by teams now weighting cost and resource exhaustion as a real security outcome rather than a billing annoyance.
Output Handling fell from fifth to tenth while absorbing more scope.
System Prompt Leakage was renamed Hidden Context Exposure — a broader and much more honest category name.
Prompt Injection expanded to cover cross-modal attacks smuggled in images and audio, and Data and Model Poisoning absorbed fine-tuning subversion rather than spawning a new entry.
The methodology change matters more than any single ranking. Every previous edition rested purely on consensus — hundreds of practitioners voting on what feels most dangerous. This time the vote carried 75% of the weight, and the remaining 25% came from 6,639 real incidents pulled from public vulnerability databases and an AI-harm database.
That's the first time this list has been partially argued from evidence rather than entirely from vibes. It shows.
The distinction that should reorganize your threat model
Buried in the release is a framing I'd argue is more useful than the ranking itself: the explicit split between treating an LLM as a component and an LLM as an actor.
A component receives input and produces output. You sanitize what goes in, you validate what comes out, and the failure mode is a bad string. We know how to reason about this. It's a parser.
An actor has tools, persistent memory, and execution rights. It holds credentials. It chains steps. Its failure mode is not a bad string — it's a bad action, taken with your authority, against a system you forgot it could reach.
Once you draw that line, the whole list reads differently. Prompt Injection at number one stops being "the model said something rude" and becomes the initial access technique. Excessive Agency at number three stops being a governance checkbox and becomes the privilege escalation step. Hidden Context Exposure becomes the loot.
That's not a Top 10. That's a kill chain.
Ten risks, ten controls
Here's the part OWASP deliberately doesn't do for you, because it varies per architecture. This is the mapping I use when I'm reviewing an LLM application, and it's the reason I think of the 2026 list as a containment spec.
| Risk | The control that actually contains it |
|---|---|
| Prompt Injection | Provenance tagging on every context segment; untrusted-origin content never inherits tool-invocation authority |
| Sensitive Information Disclosure | Retrieval-time authorization — filter the corpus by the caller's entitlements before embedding search, not after |
| Excessive Agency | An explicit autonomy ladder with per-tier approval gates; no tool graduates a tier without a written blast-radius review |
| Data and Model Poisoning | Signed, versioned training and fine-tune datasets with provenance attestation; treat a dataset like a dependency |
| Improper Output Handling | Downstream sinks assume the output is attacker-controlled — because it is |
| Hidden Context Exposure | Assume system prompt disclosure by default; never put a secret, an endpoint, or a policy decision anywhere a model can read it |
| Unbounded Consumption | Per-principal token, tool-call, and recursion budgets with hard circuit breakers, monitored as a security signal |
| Supply Chain | AI-BOM covering models, adapters, embeddings, tools, and skills — not just Python packages |
| Vector and Embedding Weaknesses | Tenant-isolated indexes; write-path validation on anything that enters the store |
| Misinformation | Grounding with citation enforcement, plus an abstention path so the system can say "not enough information" instead of confabulating |
Notice how few of those live inside the model. Nine of the ten are architecture. That is the point the leads were making.
Why the cross-framework mapping is the sleeper feature
Appendix A of the 2026 release maps every risk into the frameworks enterprises already run: the OWASP Top 10 for Agentic Applications and GenAI Data Security guidance, MITRE ATLAS, MITRE ATT&CK, CWE, NIST AI 600-1 and the AI RMF, and the CSA AI Controls Matrix.
If you have ever tried to get an AI security control funded, you know why this matters. "The model might get prompt-injected" gets you a nod and no budget. "This is ATLAS technique X, it maps to NIST AI RMF MANAGE 2.2, and our AI Controls Matrix coverage is currently zero" gets you a line item.
The 2026 edition turned itself into a translation layer between AI research vocabulary and enterprise assurance vocabulary. For anyone doing AI security inside a large organization, that's the most operationally valuable thing in the document.
What I'd actually do this week
If you own an LLM application, three things, in order:
Classify every model in your estate as component or actor. Not by intent — by capability. If it can call a tool, it's an actor, no matter what the design doc says. Most teams discover they have more actors than they thought.
For every actor, write the blast radius on one page. What credentials does it hold, what systems can it reach, and what is the worst single action it could take if fully compromised? If you can't answer in under an hour, that's your finding.
Pick your three highest-blast-radius actors and add one containment control each. Not detection. Containment. Detection tells you the model was fooled; containment is what makes that survivable.
The 2026 list is telling you the industry has stopped believing prevention will arrive. That's not pessimism. It's the same move we made with memory-safety decades ago: we stopped promising no bugs and started building systems where a bug doesn't own the machine.
Part 1 of The Agentic Attack Surface.
I write weekly on AI security, cloud security, and security architecture. LinkedIn · GitHub
Top comments (0)