OWASP Top 10 for LLM Apps 2026: Excessive agency risk on the rise | RL Blog<br>prev

next

Close

RL Blog

Spectra Assure Free Trial<br>Get your 14-day free trial of Spectra Assure for Software Supply Chain Security<br>Get Free TrialMore about Spectra Assure Free Trial

All rights reserved ReversingLabs © 2026

Back to Top

The inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security is outGET THE REPORT

Skip to main contentOpen search modalSearchClose

ReversingLabs: Home

Products & Technology

Industry

Partners

Resources

Company

Pricing

Request a demo<br>Close<br>Menu

OWASP Top 10 for LLM Apps 2026: Excessive agency risk on the rise<br>While prompt injection and data disclosure remain concerns, excessive agency climbed the list — not surprising with recent security incidents.

John P. Mello Jr., Freelance technology writer.John P. Mello Jr.

LinkedIn<br>blueskyBluesky<br>Email Us

The Open Worldwide Application Security Project’s newest OWASP Top 10 for LLM Applications includes a change that puts a spotlight on the rise of AI risk.<br>While prompt injection and the disclosure of sensitive information still hold the top two spots, excessive agency jumped from sixth place in 2025 to third in 2026 (pushing supply chain and data model poisoning risks down to the fourth and fifth slots).<br>Now part of OWASP’s GenAI Security Project and created  by hundreds of AI security experts, the OWASP Top 10 for LLM Applications 2026, provides updated rankings, expanded threat coverage, and new research based on real-world AI security incidents, all organized with the practitioner in mind.<br>“The guide provides practical explanations, attack scenarios, and actionable mitigations for developers, architects, security teams, and CISOs, while mapping risks to leading industry frameworks including NIST, MITRE ATLAS, CWE, and the OWASP Top 10 for Agentic Applications.”<br>—OWASP GenAI Security Project<br>Here are key takeaways from the OWASP Top 10 for LLM Applications 2026 — and why it's time to think beyond security controls.<br>[ Join webinar: Autonomy, Not Autopilot: Get Real About Agentic SOC ]<br>A whole new attack surface<br>Jason Soroko, a senior fellow at Sectigo, said prompt injection remains the top risk because the flaw is fundamentally architectural.<br>“[With prompt injection], instructions and data share one channel, the context window, and no equivalent of the parameterized query exists to separate them, so every mitigation lowers probability without reaching zero.”<br>—Jason Soroko<br>Pete Pickerill, co-founder of Liquibase, said no one has solved the problem. He noted that attackers can now conceal instructions inside images, audio, and documents, adding that every tool that an AI system connects to represents another potential entry point. What’s changed, he said, is the level of risk: Where a manipulated chatbot can produce an embarrassing response, a manipulated agent can take genuinely harmful action.<br>Jeremy London, director of engineering, AI and threat analytics at Keeper Security, said excessive agency’s rise reflects how organizations are deploying AI. When the list was first created, in 2024, most LLM applications were simple chat interfaces or single-step tools. By 2026, agents had become the norm — systems with persistent memory, tool access, file and API permissions, and the ability to carry out multistep tasks with varying degrees of autonomy, he said.<br>“The model is not just returning a response. It is taking action, which presents a qualitatively different attack surface.”<br>—Jeremy London<br>Larry Maccherone, founder and CTO of Lumenize, is skeptical about excessive agency’s ranking, arguing that a self-repairing system can only exist if the AI is given enough agency to fix itself — a form of recursive self-improvement, with humans providing high-level direction while the machine handles the actual repairs. Clipping an AI system’s agency in the name of safety will limit its ability to find and close its own security gaps, he said, leaving organizations with something less capable and less secure.<br>“The cure for excessive agency is more agency — pointed at the right thing.”<br>—Larry Maccherone<br>Why including incident data matters<br>New to the 2026 list is the addition of incident data in the ranking process. In the 2026 Top 10 document, the project leaders explained that this and every previous version of the list has been built on judgment, with hundreds of practitioners weighing in on what matters most.<br>This year, however, the project tested that vote against a record of what has actually gone wrong. The project pulled together records on 7,714 incidents from public vulnerability databases and an AI-harm database, then built classifiers that read them and identified 6,639 that carried enough detail to sort, said Steve Wilson, founder and co-chair of the OWASP GenAI Security Project.<br>“This was the first time in three years of doing this that we had enough data for it to really weigh into the decision making.”<br>—Steve Wilson<br>The first time...