OWASP's 2026 LLM Top 10 Is Built From Real Breaches, Not Just Opinion

For three editions, the OWASP LLM Top 10 was essentially an expert-opinion survey: a working group ranked risks based on collective judgement about what *could* go wrong. The 2026 edition, published August 3, 2026, changes that. According to reporting from Adversa AI, the new ranking is built on a 75/25 blend — 75% expert consensus, 25% real-world incident data — drawn from 6,639 documented vulnerabilities mapped against NIST, MITRE ATLAS, and CWE frameworks.

That's a meaningful methodological shift for a document that most AI security programs treat as a de facto checklist. A risk list built on incident telemetry tells you what's actually failing in production, not just what a room of practitioners worries about.

The headline move: excessive agency

Per the source reporting, Excessive Agency has climbed sharply in the 2026 rankings, reflecting a pattern PyramidLedger sees echoed across the industry: agentic deployments — systems where an LLM calls tools, executes multi-step plans, or takes autonomous actions with limited human review — are the ones generating real breach reports. Excessive Agency covers exactly this failure mode: an agent granted more permissions, tool access, or autonomy than its task actually requires, which an attacker (via prompt injection or a manipulated input) can then abuse to take unintended actions.

This lines up with the broader trend of the past two years: as organizations move from single-turn chatbots to agents wired into email, code execution, ticketing systems, and internal APIs, the blast radius of a successful manipulation grows from 'bad text output' to 'unauthorized action taken on a real system.'

Other notable shifts

• Unbounded Consumption rose four positions, reflecting incidents tied to availability abuse and financial denial-of-service — attackers driving up inference costs or exhausting rate limits/resources rather than just extracting data.
• System Prompt Leakage was renamed Hidden Context Exposure, broadening the category beyond just the system prompt to cover any hidden context (retrieved documents, tool schemas, memory) an attacker can coax a model into revealing.
• OWASP reports that eight of the ten categories moved position from the previous edition, and explicitly recommends practitioners focus on *which risks moved and why* rather than treating the numbered order as gospel.

Why this matters for AI security programs

A list re-ranked by real incidents is a better prioritization input than one ranked by anticipated risk. If your organization uses the OWASP Top 10 to scope AI red-teaming, vendor security questionnaires, or an ISO 42001 risk register, this edition is worth re-reading in full rather than assuming the old ordering still holds — particularly if you've shipped or are piloting any agentic capability with real tool access in the last year.

The practical takeaway is narrow but concrete: if your LLM-based system can call tools, write to a database, send communications, or trigger downstream workflows, Excessive Agency deserves a dedicated review — scoped permissions, human-in-the-loop checkpoints for high-impact actions, and explicit testing for whether prompt injection can be escalated into an unauthorized tool call.