Prompt Injection tops 2026 OWASP GenAI / LLM Top Ten vulnerabilities
For the third year in a row, prompt injection tops the OWASP GenAI / LLM Top Ten list issued today as being the most vulnerable practice to be exploited.
In previous years, the list was built on the judgment of voters. But, according to Steve Wilson, co-chair of the OWASP GenAI Security Project and Chief AI Officer at Exabeam, the team this year tested those votes against a record of what actually has gone wrong. “This update is grounded in much more than expert opinion,” he told SD Times in a recent interview. “OWASP now has a database containing roughly 10,000 real-world AI security incidents, giving us a clearer picture of which risks are actually showing up as organizations deploy these systems.”
One surprising finding in the list was that what users fear about AI vulnerabilities did not match the data from the incident records OWASP used to compile the list. “We learned more from the disagreements than from where they agreed,” Wilson said.
Prompt injection
In the area of prompt injection, Wilson pointed out that vulnerability occurs when input to a model, either direct input or retrieved content, changes how the model behaves — often in ways the developer did not intend. According to the report, prompt-injection vulnerabilities exist in how models process input and how that input can force the model to pass data or instructions incorrectly to other parts of the system. Wilson emphasized that models will be fooled by inputs; the example he provided is that models cannot differentiate between data and instructions. So, OWASP said in its report, organizations should build their systems around that premise so nothing important breaks.
“Prompt injection is fundamentally different from a vulnerability like SQL injection, where we know how to engineer a definitive fix,” he said. “The labs will continue making models more resistant, but prompt injection may ultimately be more like death and taxes: something organizations must continuously manage rather than expect to eliminate.”
In the same second spot as last year, sensitive information disclosure remains troublesome for organizations, as this can occur when models expose data that was not authorized to be shared. Vulnerabilities can be exposed via legacy permissions, credentials, API keys and more.
Excessive agency
Climbing the chart in third place is excessive agency, which was sixth on last year’s list and in the eighth spot before that. This creates vulnerabilities when a model is given too much functionality or too many permissions to act autonomously, which can lead to unintended actions such as when an agent is given the ability to read documents, but the tool chosen also included the ability to modify or delete other documents. Wilson said: “Excessive agency rose from eighth to third because AI systems are no longer limited to generating text. Agents can browse the internet, call tools, access business systems and take actions on a user’s behalf. When those capabilities are granted without appropriate limits, a model mistake can become a real-world security incident.”
One reason these issues are occurring, Wilson said, is that organization made such a mad rush to implement AI that much of the safeguards and practices organizations used in the pre-AI days to ensure governance, validation and security were often abandoned.
How is the 2025 OWASP LLM Top Ten different from previous years?
In previous years the OWASP LLM Top Ten was ranked primarily by expert voting. The 2025 edition cross-references those votes against a database of approximately 10,000 real-world AI security incidents, allowing the team to validate or challenge expert assumptions with empirical data. According to OWASP GenAI co-chair Steve Wilson, the team found that what practitioners feared did not always match what was actually occurring in incident records.
What is excessive agency in LLM security and why is it rising?
Excessive agency refers to giving an AI model or agent too much functionality or too many permissions to act autonomously, which can lead to unintended actions — for example, an agent granted read access that also ends up able to modify or delete documents. It climbed from eighth to third on the 2025 OWASP LLM Top Ten because AI systems are increasingly agentic, able to browse the web, call external tools, and act on a user’s behalf. OWASP recommends tightly scoped permissions and continuous behavioral monitoring to mitigate the risk.
Can prompt injection be fixed the same way SQL injection was?
No. According to Steve Wilson, co-chair of the OWASP GenAI Security Project, prompt injection is fundamentally different from SQL injection because there is no known engineering fix that definitively eliminates it. While AI labs continue to make models more resistant, OWASP advises organizations to treat prompt injection as an ongoing operational risk to continuously manage rather than a vulnerability to fully remediate.
The post Prompt Injection tops 2026 OWASP GenAI / LLM Top Ten vulnerabilities appeared first on SD Times.
Tech Developers
No comments