OWASP LLM Top 10 2026: what changed, what it means, and why Excessive Agency matters now
OWASP published the 2026 edition of its Top 10 for LLM Applications on August 3 and formally unveiled it at a September 1-2 event alongside a new Agent Control Standard. If you built your AI security program around the 2025 edition, you need to re-evaluate. Several things shifted significantly.
The methodology changed
Previous editions were pure expert opinion. The 2026 list is 75% expert consensus blended with 25% real incident data drawn from 6,639 documented vulnerabilities. This matters because it grounds the ranking in what is actually being exploited, not just what researchers believe is theoretically risky. When something moves up the list in this edition, it moved up because incidents happened.
Excessive Agency jumped from sixth to third
This is the most significant ranking change. Excessive Agency covers scenarios where an AI agent is granted more permissions, more tool access, or more autonomy than the task requires, and an attacker (or a malicious prompt) exploits that to do something the system owner did not intend.
The PaperCut AI swarm attack from earlier this month is a real-world demonstration of what Excessive Agency looks like from the offensive side: agents with full access to scanners, exploits, persistence tools, and no human checkpoint. Defenders need to apply the same principle in reverse: their AI agents should have the minimum permissions required, with explicit approval gates before irreversible actions.
The other changes worth noting
Unbounded Consumption rose four positions. This captures financial denial-of-service through runaway token or API usage, which has become a realistic threat as AI systems get embedded in cost-critical production paths. System Prompt Leakage was renamed Hidden Context Exposure and broadened to cover all forms of unintended context disclosure, not just the system prompt specifically.
Prompt Injection and Sensitive Information Disclosure held at #1 and #2. Indirect prompt injection in particular remains the dominant practical attack vector for 2026: adversarial instructions embedded in content the model retrieves or processes (web pages, documents, email, database output) rather than directly in user input.
The new Agent Control Standard
OWASP donated a companion Agent Control Standard alongside the Top 10. This gives security teams a concrete framework for applying controls to agentic deployments: minimum privilege, scope limiting per task, human-in-the-loop gates for destructive or irreversible actions, and monitoring for out-of-scope tool invocation. If you are building or reviewing AI agent systems, this is the operational layer that maps to the risk framework.
What to do with this
- Map your current AI deployments against the 2026 Top 10. Pay particular attention to Excessive Agency (#3) and Unbounded Consumption if you are running agentic systems.
- Review what tools and permissions your AI agents have. Can they send emails, modify files, call external APIs? Each of those is a potential Excessive Agency surface.
- Read the Agent Control Standard before your next AI system design review. It is short and actionable.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are working on AI security architecture or threat modeling for agentic systems and want to compare notes.