OWASP's 2026 LLM Top 10 Puts Agentic Risk First

OWASP just rewrote the list every AppSec team points to when someone asks "what could go wrong with our LLM app," and this time it didn't just ask practitioners for their gut feeling. It checked the gut feeling against real incidents.

The OWASP Top 10 for LLM Applications 2026, published August 4, 2026, moved eight of its ten entries and renamed one. The headline change: Excessive Agency jumped from sixth place to third. That's the biggest move on the list, and it's not subtle. It's OWASP saying, in a document enterprises use to justify security budget, that agents acting on your systems are now a bigger measured risk than most of the content-generation problems that dominated the 2023 and 2025 editions.

What actually changed

The new ranking, in order, is: Prompt Injection, Sensitive Information Disclosure, Excessive Agency, Supply Chain, Data and Model Poisoning, Unbounded Consumption, Misinformation, Hidden Context Exposure (the renamed System Prompt Leakage), Vector and Embedding Weaknesses, and Improper Output Handling.

Prompt Injection and Sensitive Information Disclosure held onto first and second. But Unbounded Consumption climbed from tenth to sixth, Misinformation rose two spots, and Improper Output Handling fell from fifth all the way to tenth. Read that last one twice: the risk of an LLM's output causing damage when rendered or executed dropped, while the risk of an LLM's actions causing damage climbed. That's the whole story of this edition in one comparison.

The bigger methodology shift is how OWASP got there. For the first time, the community vote only carried 75% of the ranking weight. The other 25% came from 6,639 real-world incidents pulled from public vulnerability databases and AI-harm trackers, out of 7,714 collected. Opinion still matters, but it no longer gets to override what's actually happening in production, as reported by Help Net Security and detailed in Aembit's breakdown.

Why this matters if you're the one deploying it

If your team has spent the last year hardening prompts and sanitizing outputs while giving agents broad, standing tool access "because the pilot needed it," this list is telling you that's exactly backwards from where the incidents are. Excessive Agency isn't a hypothetical: it's an agent with a database write permission it never needed, or a support bot that can issue refunds because scoping that down felt like it would slow the demo.

The uncomfortable part for leadership is that Excessive Agency is a governance failure, not a model failure. You can't patch it with a better system prompt. It gets fixed by someone deciding, before launch, exactly which tools an agent can call, with what scope, and who signs off when that scope needs to grow.

A governance artifact you can actually use

A lot of teams have no written record of what an agent is allowed to touch. Start one. It doesn't need to be fancy, it needs to exist and be reviewed on every change:

# agent-permissions.yaml
agent: support-triage-bot
owner: platform-security@company.com
last_reviewed: 2026-09-23
tools:
  - name: lookup_order
    scope: read-only
    data_boundary: customer-service-db
  - name: issue_refund
    scope: write
    max_amount_usd: 50
    requires_human_approval_above: 50
  - name: send_email
    scope: write
    allowed_domains:
      - company.com
escalation_path: on-call-security
review_cadence_days: 30

This is the kind of artifact an OWASP-aligned risk review will actually ask for now. If you can't produce something like it for every agent in production, that's your gap, not a documentation nice-to-have.

What to do Monday morning

Pull the OWASP 2026 list and map it against your production agents, not your chatbots. For each one, answer: what can it do without a human in the loop, and would you be comfortable explaining that tool list to a customer? If Excessive Agency wasn't already on your risk register above Improper Output Handling, move it there. Then go find the agent with the widest tool access and the least review, because statistically, per OWASP's own incident data, that's where the next headline comes from.

Security lists don't usually reorder themselves around evidence. This one did, and it's pointing straight at the thing most FDEs shipped fastest and reviewed least: what their agents are allowed to actually do.