OWASP's 2026 LLM Top 10: Prompt Injection Holds #1 as Agentic Risk Surges

A list grounded in incident data, not just opinion

OWASP's 2026 edition changes how the ranking is built. Previous lists ran on community vote alone; this one blends practitioner survey (75% weight) with real-world incident data (25%), drawn from 7,714 documented AI-security incidents, of which 6,639 had enough detail to classify by risk category, according to Invicti's analysis. The conservative weighting means one year of incident data can shift rankings but can't override practitioner judgment outright.

The prompt injection paradox

Prompt Injection (LLM01) keeps the top spot for a third consecutive year — despite, by OWASP's own account, having some of the thinnest incident counts on the list. The explanation OWASP gives is what Invicti calls a "defense effect": teams that treat injection as a known, serious risk invest heavily in mitigating it, so fewer clean exploits ever surface in public breach databases. As OWASP put it, per Infosecurity Magazine: "Teams fight injection hard, so fewer clean exploits reach a public database, and the public count understates the risk that mature teams already spend real money holding off."

Stop trying to build a model that cannot be fooled. Build the system around it, so that when the model is fooled – and it will be – nothing important breaks.

— OWASP Top 10 for LLM Applications, 2026 edition

What moved, and why

• LLM01 Prompt Injection — held #1.
• LLM02 Sensitive Information Disclosure — held #2.
• LLM03 Excessive Agency — up from #6, the biggest climb, reflecting agents that now invoke tools, modify files, and touch production systems.
• LLM04 Improper Supply Chain — down one, from #3.
• LLM05 Data and Model Poisoning — down one, from #4.
• LLM06 Unbounded Consumption — up four, from #10, tracking financial denial-of-service risk from runaway token/API usage.
• LLM07 Misinformation — up two, from #9, and the widest gap between practitioner vote and incident data — wrong outputs increasingly trigger downstream agentic actions.
• LLM08 Hidden Context Exposure — down one, from #7, renamed from "System Prompt Leakage" and broadened to cover RAG schemas and policy logic, not just system prompts.
• LLM09 Vector and Memory Flaws — down one, from #8.
• LLM10 Improper Output Handling — down five, from #5, the steepest fall — not because output-handling flaws were fixed, but because input-boundary risks now dominate the incident record.

Why this matters for red-teaming and governance

For teams running AI governance programs, this list functions as a prioritization map, not a checklist to tick off once. The rise of Excessive Agency and Unbounded Consumption tracks the same trend security teams are seeing first-hand: LLMs are moving from chat interfaces into agentic pipelines with real tool access, and that's where blast radius grows fastest. Treat the ranking as a signal for where red-team scope and monitoring budget should shift next — not as evidence that older risks like output handling are now safe to deprioritize.