OWASP published its 2026 LLM Top 10 on August 3. It used real incident data for the first time. Excessive Agency rose from sixth to third. The list still weights expert votes at 75%. Incident data accounts for the remaining 25%. Excessive Agency covers three root causes. These are excessive functionality, permissions, and autonomy. Prompt injection remains the top risk. Sensitive Information Disclosure stays second. Supply Chain and Data Poisoning both dropped. Unbounded Consumption jumped to sixth. Misinformation rose to seventh. Improper Output Handling fell to tenth.
What changed
OWASP LLM Top 10 rankings were based solely on expert practitioner votes.
What it unlocks
Prioritizing controls for agentic AI deployments based on real-world incident data.
- 7,714 real AI-security incidents
- 6,639 incidents classified
- 75% expert vote weight
- 25% incident data weight
Sources