The 2026 OWASP LLM Top 10 Landed. Its #1 Risk Nearly Didn’t Make the Cut.
The OWASP LLM Top 10 2026 checked the practitioner vote against 6,639 real incidents. See what moved, why prompt injection stayed #1, and how it held up.
The 2026 OWASP LLM Top 10 puts prompt injection at number one, same as every year before it. For the first time, you don’t have to take the ranking on faith anymore. Up until now, we ran this on gut. On human intuition and judgment from experts on the front lines. This time is different. For the first time, we had a corpus of reported incidents to validate our assumptions against. So we did just that. We checked our judgment against 6,639 real incidents pulled from public databases. There were differences and surprises. The risk the whole field fears most barely showed up in the record of what has gone wrong.
That gap is where this year’s story starts, and it’s why this is the first version of the list you can argue with using evidence instead of opinion.
The Question I Couldn’t Shake
For years, this list came from a vote. Practitioners score the risks, the scores set the order, and the order sends thousands of teams to their defenses. A vote is a fine way to rank risk. It captures the judgment of people who break and defend these systems for a living. It also carries their blind spots and their biases. We rank what we read about last month above what quietly broke last year. We anchor to where the previous list sat. One question kept circling me through this whole cycle. What if the risks we fear most aren’t the ones doing the most damage? There’s one honest way to answer that. Go get the record and read it.
We Went and Read the Record
We pulled 7,714 real incidents out of the public databases where these failures show up: CVE, GHSA, OSV, and the AIAAIC harm database. Then we built classifiers to read every one and sort the 6,639 that carried enough detail into the taxonomy.
The part that wasn’t clean? The incident record. It isn’t a nice, clean, tidy grid of labels. It’s the Amazon Q coding extension that shipped with a wipe-the-machine instruction committed straight into its repository. It’s the unofficial postmark-mcp package that looked helpful and quietly BCC’d a few hundred organizations’ email to a stranger. It’s the zero-click exfiltration researchers pulled off against Microsoft 365 Copilot, data walking out the door with no click from anyone. None of them arrived with a neat category stamped on the side. We read them the way an investigator reads a case file, then filed each one where it belonged. Thousands of messy, real stories, sorted into piles. Then we ranked the piles by how tall they stood.
The Vote and the Data Didn’t Match
The piles of incidents didn’t match the vote. They didn’t come close. When we lined up what practitioners fear against what the record shows, we found that the two disagree more than they agree.
Prompt injection was the first shock. The vote put it first. The record put it twelfth… TWELFTH. Out of the top 10 completely! I had to double-check the work and confirm it wasn’t an error. You could only imagine the knife-fighting it stirred up in our conversations, which was exactly the spark I was hoping for! A quiet incident trail is what a well-defended risk looks like from the outside. Teams pour money into fighting injection, so the clean exploits mostly get caught, and the public record only ever logs the ones that slipped through anyway. Read that thin incident trail correctly, and you’ll see it’s the receipt for how hard the field already works to keep prompt injection from landing. The attack surface still sits everywhere a model reads input you don’t control, which is to say everywhere. Meaning that prompt injection led to many of the other incidents in their final reported form. For example, prompt injection often leads to hidden context exposure. It stays at number one, and the low count is the proof of what that number one already costs to hold.
Misinformation was the second shock, and it ran the opposite direction. Voters buried it near the bottom. The record put it second, one of the most common failures in the whole incident corpus. That’s the widest split on the list, and it points where it hurts, low fear meeting high reality. Picture a retrieval agent that reports a customer as identity-verified when they aren’t, and a payment agent downstream that trusts that answer and releases the money. There’s no exploit here and no injection, only a confident, fluent, wrong answer moving funds. The system did precisely what it was told. The telling was wrong. The record says that failure lands far more often than the vote ever assumed.
Why We Trusted the Experts Anyway
This is the fork where it would be easy to do the dumb thing. The data disagrees with the experts, so follow the data. We didn’t. We weighted the vote at three-quarters and the incident data at one-quarter, and we chose that split on purpose.
One noisy year of public incidents doesn’t get to overturn the judgment of the people who live inside these systems. The record runs late by design. It only sees a risk after enough victims have filed reports, and the threats that will define next year are the ones with almost no incident history today, because they’re too new to have victims yet. A list built only on the record would rank those at the bottom and get people hurt. The experts feel them coming. The data is blind to them. The vote is how they make the cut. A quarter weight is enough to drag an entry a full tier when belief and reality split wide open. It isn’t enough to let a messy corpus rewrite the list on its own. The vote leads. The data keeps it honest. That balance set every final slot.
That balance also reshuffled the board.
Excessive Agency made the biggest jump, from sixth to third, because the vote and the record finally agree that handing an agent real permissions is where the damage now lands. Unbounded Consumption rose four spots as runaway cost stopped reading like a footnote. Improper Output Handling slid from fifth to tenth. System Prompt Leakage grew up into Hidden Context Exposure, a wider name for the same mistake of trusting information that should have stayed out of reach. A few entries also swallowed the newest attacks whole instead of spinning off thin categories nobody would use. Prompt injection now covers the cross-modal tricks that smuggle instructions inside an image or an audio clip. Supply Chain now owns the poisoned model artifact that isn’t what it claims to be. Two entries didn’t move at all. Prompt injection held the top for the reason you now understand. Sensitive Information Disclosure held second, the one seat where the vote and the record simply shook hands, which is why it’s the entry I’d trust the most.
Then We Tried to Break It
By now a sharp reader has a knife out. If the whole thing rests on classifiers reading incident text, what happens when you hand the job to a smarter model? Maybe the order is only an artifact of a weak tool. That’s a fair question, and we asked it before you could. Four frontier models re-labeled the evaluation set. We fixed the rule for winning before any of them ran. Beat the ranking’s accuracy floor, or the list stands as written.
None of them beat it. The floor scored 0.863. The best challenger reached 0.744, and the rest came in under that. We checked the order against hand-graded truth directly too, and it lined up at a correlation of 0.918. A smarter classifier bought a better reader. It didn’t buy a different list. The order held steady while the measurement sharpened, which is the exact combination you want sitting under something teams build controls around.
What the 2026 OWASP LLM Top 10 Asks of You
You walk away from this with one thing above the rest. The list used to be a survey of what scares us. Now it’s that survey checked against what has already gone wrong, with the gaps between the two out in the open where you can weigh them yourself.
One line is worth drawing before you start. This list owns the risk while the model is a component inside your app. The moment it becomes an actor, calling tools, carrying memory between sessions, setting things in motion downstream, the risk moves to the OWASP Agentic Top 10. Read an entry here, then pair it with the Agentic list the day your model starts acting on its own.
The order still tells you where to spend first. Excessive Agency at three means your agent deployments earn budget this quarter, not next. Misinformation at seven means the checks your agents run on their own output carry weight, so build them like they do. Prompt injection at one, with its quiet little incident trail, is the standing reminder that the risk costing you the most rarely shows up loudest in the report. Work all ten. Start at the top. Build each one for the day the model gets turned against you.
The People Who Built the 2026 OWASP LLM Top 10
None of this came out of a model or a spreadsheet. It came from people. Steve Wilson leads the project. I co-lead it. The entry leads dragged each risk from a rough proposal to a published standard:
Prompt Injection, Rachel James
Sensitive Information Disclosure, Emmanuel Guilherme and Ken Huang
Excessive Agency, Andy Smith
Supply Chain, John Sotiropoulos and Stefano Amorelli
Data and Model Poisoning, Sumeet Jeswan, Mark Roxberry, and Anitha Dakamarri
Unbounded Consumption, Sahil Mehta and Venkata Sai Kishore Modalavalasa
Misinformation, Steve Wilson
Hidden Context Exposure, Alex Leung, Vinnie Giarrusso, and Sonu Kumar
Vector and Embedding Weaknesses, Savio Dsouza and Arshi Chadha
Improper Output Handling, Rico Komenda and Gavin Klondike
Dozens more drafted, argued, voted, and tested entries against the record. The release is theirs as much as ours.
Key Takeaway: The 2026 OWASP LLM Top 10 is the first version you can check against the evidence instead of taking on trust. The vote tells you what the field fears. The incidents tell you what it has already been burned by. This year, for the first time, you get to read both and see exactly where they disagree.
What to Do Next
Pull the list this week and walk it against what you’ve shipped. For every entry, answer two questions on paper. Where does this risk live in my stack, and what breaks if the model behind it gets fooled? That’s Create and Adapt work in the CARE model, and it’s the line between reading a list and running one.
For the deeper argument on why boxing in what an agent can touch beats trusting what it decides, I made that case in Least Agency vs Agent Autonomy. For where the market has and hasn’t built defenses across these same risks, see the AI Defense Matrix coverage gap. The advisory work lives at rockcyber.com.
👉 For ongoing analysis of agentic AI governance frameworks, the conversation at RockCyber Musings and you can subscribe above
👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.
👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com
👉 As a bonus, check out my conversation with Sean Martin from ITSP Magazine and John Sotiropoulos, Co-lead of the OWASP GenAI Security Project Agentic Security Initiative, during Infosecurity Europe about the newly launched OWASP Agentic Security Council, the alarming drop in attacker dwell time from eight hours down to twenty-two seconds, and what's new in the 2026 OWASP Top 10 for LLM.