OWASP's 2026 LLM Top 10: Prompt Injection Stays #1, Now Data-Backed

OWASP's GenAI Security Project has published the latest edition of its Top 10 for LLM Applications, and the headline result is continuity: Prompt Injection keeps the #1 ranking it held in the 2025 list. What's new is how that ranking was produced.

A ranking now anchored in incident data, not just expert opinion

Previous editions of the list were built almost entirely from practitioner consensus. The 2026 edition blends that expert vote (75% of the weighting) with empirical incident data (25%) — 6,639 real-world incident reports pulled from public vulnerability databases and OWASP's own AI-harm database, part of a broader repository the project says now holds close to 10,000 logged AI security incidents. OWASP GenAI co-chair Steve Wilson framed the shift plainly: the project wanted a ranking "grounded in much more than expert opinion."

Why prompt injection still tops the list despite few clean incidents

On raw incident counts, prompt injection doesn't look like the biggest problem — and OWASP addressed that directly, calling it a defense effect: security teams work hard enough to block injection attempts that fewer successful attacks ever surface in public incident data, which understates rather than reflects the underlying risk. The report singles out indirect prompt injection — adversarial instructions smuggled into retrieved documents, web pages, or tool outputs rather than typed by a user — as exploitable across essentially every RAG-enabled or agentic system in production. Wilson described the risk as "fundamentally different from a vulnerability like SQL injection, where we know how to engineer a definitive fix."

The other significant mover: Excessive Agency

Excessive Agency climbed to #3, up from 6th place in 2025 — the clearest sign in this edition that the threat model is shifting from LLMs as text generators to LLMs as agents with tool access, file permissions, and the ability to take real-world actions. Wilson's framing: "When those capabilities are granted without appropriate limits, a model mistake can become a real-world security incident." Sensitive Information Disclosure held steady at #2, unchanged from the prior edition. Several other categories were renamed or folded into existing entries as the taxonomy matures — System Prompt Leakage, for instance, is now covered under a broader Hidden Context Exposure category.

What this means for teams building or buying LLM/agent systems

• Treat prompt injection as an assumed-breach problem: no system prompt or output filter reliably stops it, so design the surrounding system — permissions, human approval steps, tool scoping — so that a fooled model can't cause serious damage.
• Prioritize testing indirect prompt injection specifically in RAG pipelines and agent-to-tool integrations; that's the vector OWASP flags as exploitable in practice, not a theoretical one.
• Revisit agent permission scoping in light of Excessive Agency's rise — least-privilege tool access and approval gates for consequential actions, not implicit trust in model output.
• Expect the OWASP LLM Top 10 to keep showing up as a reference baseline in AI governance and audit conversations, including ISO 42001 programmes, as its methodology becomes more evidence-based.

The full report is worth reading directly for teams shipping LLM or agentic features: the ranking itself is a decent proxy for where attackers and auditors will look first.