OWASP Admitted the Model Will Be Fooled

Last month, OWASP (the Open Worldwide Application Security Project) released the 2026 edition of its Top 10 for LLM Applications, and the design philosophy behind the whole document is basically that headline, made official: stop trying to build a model that can't be fooled. Assume it will be. Harden everything around it so that when it is, the damage is contained.

That's a governance statement as much as a security one, and it's why I wanted to spend a post on it.

The updated 2026 list

  1. Prompt Injection

  2. Sensitive Information Disclosure

  3. Excessive Agency

  4. Supply Chain

  5. Data and Model Poisoning

  6. Unbounded Consumption

  7. Misinformation

  8. Hidden Context Exposure

  9. Vector and Embedding Weaknesses

  10. Improper Output Handling

What changed

Prompt Injection stayed at #1 and Sensitive Information Disclosure stayed at #2 — read the headline and you'd think nothing moved. Eight of the ten entries moved. Nothing was added or dropped, but the middle of the list got reshuffled hard, and the reason is the method.

For the first time, the ranking wasn't just a practitioner vote. The vote still carried 75% of the weight, but the other 25% came from a database of 6,639 real-world incidents. That's a big deal for a field that has run mostly on expert opinion.

The biggest move: Excessive Agency jumped from sixth to third. OWASP calls it the most consequential change on the list, and it should be — a model that answers questions and a model that can call tools, hold memory, and take actions are two completely different risk propositions. The list now says so out loud. The biggest drop: Improper Output Handling fell from fifth to tenth, and got broader on the way down — it now covers the insecure code that coding assistants generate at scale. And System Prompt Leakage was renamed Hidden Context Exposure, widening from "your system prompt leaked" to "any of the context your application holds — retrieved documents, tool results, session data — can leak."

One more detail worth knowing: when OWASP checked the rankings against the incident data, prompt injection came out first on the vote and outside the top ten on the incident record — and they kept it at #1 anyway. The incident data isn't wrong; it's incomplete. A lot of the biggest LLM incidents never get a CVE. OWASP showed the vote, showed the data, and explained the call in public. Remember that for my third point.

My take on it

Three things.

First, if your AI risk work is built on the 2025 list, it needs to be updated. This isn't a cosmetic refresh — these are real moves based on actual data, and any organization should take notice and adjust to the 2026 list. AI continues to develop at a rapid pace, and our risk work has to keep up with it.

Second, take OWASP's philosophy seriously as a governance principle: your controls should assume the model gets compromised and limit what it can reach. Least privilege for AI isn't a nice-to-have — it's the whole game once "the model will be fooled" is the premise. Both the CISSP and the AAISM talk about defense in depth, and this is exactly where it belongs. You need multiple layers of defense protecting your LLM from various exploits, because no single layer is going to hold.

Third, borrow OWASP's honesty about measurement. Show where your rankings come from. If your incident data and your experts disagree, say so and explain the call.

Companies need to look hard at their own LLMs — and keep asking questions and pushing back, whether the model comes from a third party or was built in house. These updates need to be taken seriously, with the proper controls put in place as AI continues to advance. As an industry, we have to be prepared and keep working together on what the data is showing us about where the weakest links are. That's how we put our defenses at the weakest link — and stay on the offense as AI continues to grow.

Sources