OWASP Rebuilt Its LLM Top 10 Around 6,639 Real Incidents, and Excessive Agency Climbed to Third

OWASP published the 2026 edition of the Top 10 for LLM Applications on 3 August 2026, during Black Hat USA week. What changed this year is the ranking methodology. For the first three years the ranking came from practitioner vote alone. This edition weighted expert consensus at 75% and documented real-world incidents at 25%, drawing on 6,639 cases from public vulnerability databases and an AI-harm database.

Prompt Injection and Sensitive Information Disclosure held the top two places. Excessive Agency climbed to third, up from sixth in the 2025 edition, and the incident data is the reason given. Data and Model Poisoning absorbed fine-tuning subversion into its scope. Output Handling sits at the bottom of the list.

The project leads gave the framing I would build a control programme around: "Stop trying to build a model that cannot be fooled. Build the system around it, so that when the model is fooled, and it will be, nothing important breaks."

The methodology change is the story

A ranked list assembled by expert vote measures what practitioners are worried about. A ranked list weighted 25% by 6,639 documented cases measures where failures are actually landing. Running both together, and then watching an entry move four places, produces a signal that neither input gives on its own.

Excessive Agency moved because agentic deployments shipped. An LLM with tool access, an API key, and a loop is a system that takes actions with consequences, and the incident record now contains enough of those consequences to outweigh three years of practitioner ranking. I track that curve in the agentic AI news pillar, and the OWASP movement is the first time a major framework has repriced it using incident evidence rather than argument.

The entries a policy gateway has no claim on

Half this list sits outside what an identity-aware gateway does, and a mapping that covers all ten entries is a mapping nobody should trust.

Data and Model Poisoning spans pretraining corpora, fine-tuning pipelines, and retrieval stores. That is data governance and MLOps work: provenance on the training set, integrity checks on the pipeline, controls on what gets written into a vector store. Supply chain integrity of model artifacts is a signing and attestation problem at the point a checkpoint is pulled. Misinformation is a model-layer and evaluation concern, addressed through grounding, retrieval quality, and human review of output. A proxy on the HTTP path cleans no training set and verifies no checkpoint. Say that plainly at the start of any control programme, or the programme has a hole in it that a mapping table conceals.

Excessive Agency is an authorization problem

The entry describes an LLM-based system taking actions beyond what the situation warranted, through excessive permissions, excessive functionality, or excessive autonomy.

The permissions half of that is a control most teams already know how to build and have not applied here. An agent typically runs with one service credential that carries the union of everything any user of that agent might need. A finance analyst asks a question and the agent's outbound call to a model, or to a tool, carries privileges assembled for the whole user population. The evaluation that matters happens per call, against the identity that originated the request, before the call leaves the boundary. That is the post-authentication gap applied to tool use: the caller authenticated, and nothing then asked whether this caller may do this thing with this content right now.

Take a concrete version of that. An agent with a shared key calls a model to summarise a customer record and then calls an internal API to update it. Two outbound requests, one ambient privilege set, zero identity-scoped decisions in between. The control is a policy decision point on each request that reads the originating principal, the data classification in the payload, and the destination, and denies by default when any of the three is ambiguous.

Prompt Injection stays first because it stays unsolved

The 2026 list keeping Prompt Injection at number one, in an edition weighted by incident data, settles an argument that ran through all three prior editions. Detection heuristics improved over those years, model providers shipped better refusal behaviour, and the documented incidents kept arriving anyway.

The gateway's contribution is narrow and worth stating precisely. Inline policy on the traffic evaluates what is being sent and where, so an injected instruction that tries to redirect a request to an unregistered endpoint or attach classified content meets a rule before it leaves. The per-decision record then shows what was actually sent, which is the artifact an investigation needs when a model behaved oddly and nobody can reconstruct the prompt. Neither of those makes a model injection-proof, and the OWASP framing already conceded that point. The production view of prompt injection covers the failure modes in more detail.

Sensitive Information Disclosure is inspection on both halves

The second-place entry covers sensitive data reaching a model in a prompt and sensitive data returning in a response. Both directions travel as HTTP payloads to and from a model endpoint.

Request-side inspection classifies content inside the context window rather than at the document level, which is the distinction legacy DLP misses on this traffic. IBM's Cost of Data Breach research found that customer PII exposure reached 65% in shadow AI breaches against 53% across all breaches, and those breaches took 247 days to detect. Response-side inspection covers the case where the model returns data the caller was never entitled to, joined to the request that produced it.

The three-entry mapping

Three rows carry a full yes or a strong partial, and those three are where a control plane on the AI request path earns its place. The rest belongs to other teams and other budgets.

DeepInspect

This is exactly what DeepInspect does. DeepInspect sits inline between your users or agents and the LLM APIs they call. For every request and response it evaluates identity, prompt classification, model authorization, and organizational policy, and makes a pass or block decision before the traffic reaches the model.

Against the 2026 list that covers the Excessive Agency row through per-call authorization bound to the originating principal rather than the agent's ambient credential, the Sensitive Information Disclosure row through inspection in both directions, and the evidential half of Prompt Injection through a signed per-decision record the calling application never had custody of. The risk taxonomy itself and the separate agentic applications controls mapping cover the neighbouring ground. Book a demo today.