"Teams fight injection hard, so fewer clean exploits reach a public database, and the public count understates the risk that mature teams already spend real money holding off," the OWASP report read.
Prompt injection: top-ranked threat despite few recorded incidents
On August 4, 2026, the Open Worldwide Application Security Project (OWASP) published the third version of its community-driven Top 10 for LLM Applications list and, for the third consecutive year, practitioners placed prompt injection at the top of the list. The report makes a striking distinction: if the ranking were based solely on raw incident counts, prompt injection would not even reach the top ten. Instead, its prominence reflects the concentrated effort and resources security teams devote to preventing it.
OWASP defines prompt injection as when a legitimate user’s or malicious actor’s input into an LLM alters the model's behavior in ways the application developer did not intend. The vector can produce bias or harmful content and can enable sensitive information disclosure. The foundation recommends designing systems on the explicit assumption that the model's instruction boundary will eventually be bypassed, and constraining what the model is permitted to do and where its outputs are permitted to reach.
Sensitive information disclosure: second place, and closely matched by incidents
Sensitive information disclosure retained the number two position for the second year running. OWASP describes this threat as the exposure of confidential, regulated, privileged, or proprietary data through an unauthorized channel, typically when sensitive data such as protected personal information, financial data and credentials are accidentally input into a model by users and later exposed in interactions.
Unlike prompt injection, OWASP notes that practitioner perception and the evidence of real-world incidents for sensitive information disclosure align closely. The report highlights that this threat represents significant data breach and regulatory dangers for organizations and offers a tiered structure of mitigations to help security teams implement protections along a graduated path.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble →Excessive agency: fast growth into third place
Excessive agency climbed sharply, moving from sixth to third in this year's list. OWASP links this vulnerability to excessive functionality, excessive permissions and excessive autonomy — conditions that enable damaging actions in response to unexpected, ambiguous or manipulated outputs from an LLM.
Common impacts include providing the LLM with functions not intended for the application, such as deleting or modifying documents, and failures to filter input instructions that command actions outside the intended operation. Recommended mitigations are practical and surgical: minimize the tools that LLM agents can use, minimize tool functionality, and minimize tool permissions.
Misinformation and unbounded consumption: movers with different drivers
Misinformation rose from ninth to seventh place. OWASP defines it as LLM outputs that are incorrect, incomplete, unsupported or misleading yet credible enough to influence human decisions, automated workflows or agent actions. The report identifies causes including hallucinations, ambiguous prompts and biased data, and advises that outputs be required to be grounded in authoritative and current sources and that LLMs verify claims before acting.
Unbounded consumption advanced from tenth to sixth, driven by the resource and cost burden of addressing the issue. OWASP explains unbounded consumption as when an application permits excessive and uncontrolled inferences, enabling attackers to disrupt availability, impose unsustainable financial costs, or steal intellectual property via model cloning. Recommended controls include applying quotas to restrict the number of requests a single source can make in a time period and deploying sandbox techniques to constrain access to network resources, internal services and APIs so attackers cannot exfiltrate data to external destinations.
What this means for developers, policymakers, and enterprises
- Developers, data scientists and security teams: OWASP frames its Top 10 as a tool to help these practitioners prioritize security strategies. Teams are urged to design systems that assume instruction-boundary bypasses, to constrain model outputs and permitted actions, and to implement tiered mitigations — for sensitive data, quotas and sandboxes, and for agentic systems, reduced tool permissions and functionality.
- Policymakers and regulators: The report underscores that sensitive information disclosure aligns with measurable incidents and thus represents clear regulatory and breach risk. The tiered mitigation guidance could inform compliance expectations tied to data protection and operational controls.
- Affected enterprises and procurement leaders: OWASP’s findings suggest that mature teams are already allocating budget and operational effort against prompt injection and other threats. The foundation’s recommendations — including quotas, sandboxing and minimization of agent capabilities — provide concrete controls enterprises can require from vendors or implement in-house.
OWASP also added a governance tool in June by rolling out an agentic AI security maturity framework intended to help organizations close the gap between the agentic systems they deploy and the governance those systems require. Taken together, the Top 10 updates and the maturity framework point toward an operational playbook: assume breach of instruction boundaries, limit what agents can do, and apply graduated controls where sensitive data or powerful tooling are in use.
The practical takeaway is unambiguous: the list does not simply catalogue faults — it shows where work is already happening and where the balance of risk and expense now lies. OWASP’s guidance makes clear that, for LLM applications, prevention will be as much about system design and governance as it is about patching individual model failures.
https://www.infosecurity-magazine.com/news/prompt-injection-llm-risk/
