The OWASP LLM Top 10 2026 checked the practitioner vote against 6,639 real incidents. See what moved, why prompt injection stayed #1, and how it held up.
The Misinformation jump to second is the one I'd sit with. No exploit involved, just a confident wrong answer the next agent trusts and acts on. I hit this in my own lab: a local model handed back fluent, well-formatted output that was flat wrong, and nothing downstream caught it. Are teams actually building output-validation gates between agents, or is that still the step everyone skips?
The vendor side moved in the same week. On August 10, OpenAI told Daybreak customers running Codex to switch from full-access mode to auto-review, which evaluates actions requiring elevated permissions before they execute, and to use scoped permission profiles defining which systems and actions are authorised. It also listed sandboxing without open internet access as a default rather than an option. That is prompt injection being treated as an architecture problem rather than a filtering one, which is roughly why the risk holds its position year after year. The mitigation keeps landing outside the model.
The 2026 OWASP LLM update reframes AI security as an active breach-response priority, backed by over 6,000 real-world production incidents. Because top threats like Prompt Injection and Excessive Agency emerge dynamically during live execution, static testing falls short, requiring organizations to focus on runtime detection, behavioral monitoring, and strict harness-level access controls.
The Misinformation jump to second is the one I'd sit with. No exploit involved, just a confident wrong answer the next agent trusts and acts on. I hit this in my own lab: a local model handed back fluent, well-formatted output that was flat wrong, and nothing downstream caught it. Are teams actually building output-validation gates between agents, or is that still the step everyone skips?
The vendor side moved in the same week. On August 10, OpenAI told Daybreak customers running Codex to switch from full-access mode to auto-review, which evaluates actions requiring elevated permissions before they execute, and to use scoped permission profiles defining which systems and actions are authorised. It also listed sandboxing without open internet access as a default rather than an option. That is prompt injection being treated as an architecture problem rather than a filtering one, which is roughly why the risk holds its position year after year. The mitigation keeps landing outside the model.
The 2026 OWASP LLM update reframes AI security as an active breach-response priority, backed by over 6,000 real-world production incidents. Because top threats like Prompt Injection and Excessive Agency emerge dynamically during live execution, static testing falls short, requiring organizations to focus on runtime detection, behavioral monitoring, and strict harness-level access controls.