Prompt injection attacks remain the most dangerous threat posed by large language models, according to an updated analysis from the Open Worldwide Application Security Project (OWASP). The non-profit foundation released the third version of its community-driven Top 10 for LLM Applications list on August 4, 2026. For the third consecutive year, security practitioners placed prompt injection at the top of the list as the number one security challenge stemming from the use of GenAI tools, even though relatively few recorded incidents relate to this attack vector.
The rankings reveal a significant disconnect between public incident data and professional concern. If the list were determined solely by raw incidents, prompt injection wouldn't even appear in the top 10, the report noted. Sensitive information disclosure held second place for the second year running, representing a close match between practitioner perception and real-world incident evidence. Excessive agency climbed dramatically from sixth place to third, while misinformation jumped from ninth to seventh. Unbounded consumption moved from tenth to sixth, which OWASP attributed to the resources and costs needed to address this issue.
The fact that security practitioners rank prompt injection so highly despite the low public incident count indicates the substantial efforts teams invest in combating this threat, according to the report. "Teams fight injection hard, so fewer clean exploits reach a public database, and the public count understates the risk that mature teams already spend real money holding off," the OWASP report stated. Prompt injection occurs when a legitimate user's or malicious actor's input into an LLM alters the model's behavior in ways the application developer didn't intend, serving as a pathway to various negative impacts including bias, harmful content, and sensitive information disclosure. The most effective approach to tackling prompt injection is to design the surrounding system on the explicit assumption that the model's instruction boundary will eventually be bypassed, and constrain what the model is permitted to do and what its outputs can reach, OWASP wrote.
The report's identification of fast-growing threats reveals where LLM vulnerabilities are evolving most rapidly. Excessive agency enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM, primarily caused by excessive functionality, permissions and autonomy. Common impacts include providing the LLM with functions that weren't intended, such as deleting and modifying documents, and the LLM failing to properly filter input instructions for commands outside what's necessary for the intended operation. Misinformation produces incorrect, incomplete, unsupported, or misleading information that appears credible enough to influence human decisions, automated workflows or agent actions, potentially resulting in security incidents, financial loss or operational disruption. The report noted that misinformation is one of the top LLM threats based on incident occurrence, caused by factors including hallucinations, ambiguous prompts and biased data. Unbounded consumption allows excessive and uncontrolled inferences, enabling attackers to disrupt service availability, inflict unsustainable financial costs, or steal intellectual property through model cloning.
OWASP recommended a range of mitigations across the threat landscape. For excessive agency, teams should minimize the tools that LLM agents can use, minimize tool functionality and minimize tool permissions. To combat misinformation, outputs should be grounded in authoritative and current sources, with the LLM verifying claims before acting. For unbounded consumption, teams should apply quotas to restrict the number of requests a single source entity can make in a given time period, and deploy sandbox techniques to constrain the LLM's access to network resources, internal services and APIs. In June, OWASP rolled out a new agentic AI security maturity framework intended to help organizations close the gap between the agentic systems they deploy and the governance those systems require. The gap between visible exploits and actual risk exposure suggests that organizations may be operating under false confidence if they rely on public incident databases alone to calibrate their defenses. As autonomous AI agents gain broader permissions and capabilities, the window for containing mistakes before they cascade into material damage will continue to shrink.