The OWASP LLM Top 10 has a few surprises for you
This podcast episode breaks down the 2026 OWASP LLM Top 10, highlighting a significant rise in concern for 'Excessive Agency' over traditional prompt injection. It explores the discrepancies between practitioner fears and incident data, particularly regarding misinformation, and advocates for viewing security frameworks as tools for operationalization and cyber resilience, not just compliance. The discussion also covers CISA's new SBOM guidance, emphasizing the need to operationalize supply chain data for effective risk reduction, and shares Black Hat 2026 insights on AI agents as a new attack surface, introducing the concept of 'intent collusion' and underscoring the critical need for foundational security principles like least privilege.
The discussion opens with the 2026 OWASP Top 10 for LLM applications, noting that prompt injection remains the top concern. However, Excessive Agency dramatically jumped to third place, signaling a critical shift in perceived risks. Seth Glascow highlights that agents act like privileged accounts, having extensive access and the ability to perform actions automatically, which makes containing them a fundamental security challenge. Ryan Anuts emphasizes that the OWASP list should serve as a common language for AI risk, advocating for its use in tabletop exercises to test detection, containment, and reconstruction capabilities rather than as a mere compliance checklist. He points out that the focus has shifted from manipulating what an AI says to manipulating what it does.
An interesting aspect of this OWASP list is its unique methodology, incorporating both community votes and real-world incident data. This revealed discrepancies between practitioner concerns and incident statistics:
- Prompt Injection: Practitioners see it as the top concern, yet incident data shows it as low. OWASP suggests this is due to robust defenses built because of its obvious attack surface.
- Misinformation: Practitioners rank it low, but incident data indicates it’s a significant problem. Seth explains that misinformation is harder to detect, can cause perpetual issues with agentic systems, and is not perceived as a direct attack surface like prompt injection. Ryan adds that user conditioning to