Prompt injection attacks continue to present the most dangerous threat from large language models (LLMs), despite the relatively low number of recorded incidents relating to this vector, according to an updated analysis from the Open Worldwide Application Security Project (OWASP).
The non-profit foundation published the third version of its community-driven Top 10 for LLM Applications list, on August 4, 2026. For the third year in a row, practitioners listed prompt injection as the number one security challenge emanating from the use of GenAI tools.
Like other OWASP Top 10 lists, this document is designed to help developers, data scientists and security professionals improve and prioritize their security strategies.
Prompt injection is when a legitimate user’s or malicious actor’s input into an LLM alters the model’s behavior in ways the application developer did not intend. It is a vector to a range of negative impacts, including bias or other harmful content and sensitive information disclosure.
The OWASP report noted that were its rankings determined by raw incidents alone, prompt injection wouldn’t even make the top 10 list. The fact security practitioners rank it so highly is indicative of the efforts spent by teams in tackling this threat.
“Teams fight injection hard, so fewer clean exploits reach a public database, and the public count understates the risk that mature teams already spend real money holding off,” the OWASP report read.
The most effective approach to addressing prompt injection is to design the surrounding system on the explicit assumption that the model’s instruction boundary will eventually be bypassed, and constrain what the model is permitted to do, and what its outputs are permitted to reach, OWASP wrote.
Read now: What the OWASP Top 10 for LLMs Means for the Future of AI Security
Sensitive Information Disclosure
Sensitive information disclosure was ranked as the second biggest LLM threat for the second year running. This occurs when an LLM-integrated system exposes confidential, regulated, privileged, or proprietary data through an unauthorized channel.
It typically occurs when sensitive data, such as protected personal information, financial data and credentials are accidentally inputted into a model by users, and later exposed in interactions with users. This threat represents significant data breach and regulatory dangers for organizations.
Unlike with prompt injection, the OWASP report noted that the perception of the threat of sensitive information disclosure from practitioners and evidence of real-world incidents correspond closely.
OWASP highlighted a number of mitigations security teams should employ to tackle this risk, offering a tiered structure for a graduated implementation path.
The Fastest Growing LLM Threats
Excessive agency was considered by practitioners to have grown considerably as a threat from LLMs, moving from sixth place to third. This vulnerability enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM. It is primarily caused by excessive functionality, excessive permissions and excessive autonomy.
Common impacts from excessive agency include providing the LLM with functions that were not intended, such as deleting and modifying documents, and the LLM failing to properly filter the input instructions for commands outside what’s necessary for the intended operation of the application.
Advised mitigations from OWASP include minimizing the tools that LLM agents can use, minimizing tool functionality and minimizing tool permissions.
Misinformation was another significant mover in 2026, from ninth to seventh place.
Misinformation occurs when an LLM produces incorrect, incomplete, unsupported, or misleading information that appears credible enough to influence a human decision, automated workflow or an agent action. This can result in dangerous consequences, including security incidents, financial loss or operational disruption.
OWASP noted that misinformation is one of the top LLM threats based on incident occurrence.
It can be caused by a range of factors, including hallucinations, ambiguous prompts and biased data.
Among the recommended mitigations for security teams are to require outputs to be grounded in authoritative and current sources and ensuring the LLM verifies claims before acting.
Unbounded consumption moved from tenth to sixth place, which OWASP said was the result of the resource and costs required to tackle this issue.
Unbounded consumption is when an LLM application allows excessive and uncontrolled inferences, enabling attackers to disrupt service availability, inflict unsustainable financial costs, or steal intellectual property through model cloning.
It is enabled by the absence of adequate controls over how resources are consumed by the LLM. OWASP advised teams to apply quotas to restrict the number of requests a single source entity can make in a given time period. In addition, sandbox techniques can be deployed to constrain the LLM’s access to network resources, internal services and APIs, thereby restricting an attacker’s ability to exfiltrate data to an external destination.
In June, OWASP rolled out a new agentic AI security maturity framework intended to help organizations close the gap between the agentic systems they deploy and the governance those systems require.
