“The model will be fooled”: what the OWASP GenAI LLM Top 10 2026 teaches

On August 4 the OWASP GenAI Security Project published the 2026 Top 10 for LLM applications. The news is not the order of the entries: it is the method. For the first time, expert judgment was tested against thousands of real incidents — and where the two disagree lies the most useful lesson for anyone running these applications in a company.

A vote tested against the evidence

Every previous edition was built on consensus: hundreds of practitioners voting on what they consider most dangerous. This year the project assembled a corpus of 7,714 real incidents from public vulnerability databases and an AI-harm database, classified 6,639 of them with sufficient detail, and asked a blunt question: does what practitioners fear match what the incident record shows? The answer — stated with a candour rare in industry documents — was: not always. In the final scoring the community vote carries 75% of the weight and the data 25%: enough to move an entry when the gap between belief and evidence runs wide, not enough for one noisy year of data to rewrite the list.

The 2026 list

The top seeds do not move: Prompt Injection and Sensitive Information Disclosure hold the first two places. Below them, the order changed more than in any previous edition — and every move tells a story.

The prompt injection paradox

The most instructive datum in the document is an admission: if the ranking were built on recorded incidents alone, prompt injection would fall out of the Top 10 entirely. Yet it stays first. OWASP's explanation is what it calls a defense effect: teams fight it hard, so few clean exploits reach public databases — but the attack surface remains everywhere a model reads untrusted input, which is to say everywhere. It is a risk-management lesson that reaches well beyond AI: the absence of recorded incidents is not the absence of risk; historical data systematically understates the risks you are already paying to contain.

Hence the sentence at the heart of the preface, worth quoting in full: "Stop trying to build a model that cannot be fooled. Build the system around it, so that when the model is fooled, and it will be, nothing important breaks."

The most dangerous gap: Misinformation

The most interesting disagreement runs the other way. Practitioners vote Misinformation near the bottom of the list; the incident record places it near the top. It is, in the document's words, the widest gap in the direction that actually hurts: where perception is low and evidence is high. The mechanism is banal, which is why it is underestimated: when a model's fluent, confident output drives a decision or a tool call, a wrong answer becomes a wrong action. No attacker required — a hallucination in an unverified process is enough. For organisations using LLMs in office work — drafts, summaries, customer replies, screening — this is the risk closest to real processes, and precisely the one technical teams tend to file under "not a security problem".

Excessive Agency on the podium: where vote and data agree

Excessive Agency's climb from sixth to third is the most consequential move, because there the vote and the evidence point the same way: production incidents cluster around systems where model output autonomously executes commands, invokes APIs, manages transactions. The document also draws an explicit boundary: this list covers the model as a component inside an application; the moment the model becomes an actor — with tools to call, memory carried between sessions, consequences set in motion downstream — the risk moves to the OWASP Agentic Top 10, and "neither one covers that ground alone". It is the territory we covered writing about the lethal trifecta and authorization moving to the data: anyone putting agents in production today must read both lists.

The consolidations are also worth noting: rather than spawning thin new categories, 2026 broadens the existing ones. Prompt injection now covers cross-modal attacks (instructions hidden in images or audio), Supply Chain includes model artifacts that are not what they claim to be, Poisoning absorbs fine-tuning subversion, and Output Handling spans the insecure code assistants generate at scale.

How to use it in your company

Appendix A maps every entry to nine external frameworks — the two sister OWASP lists (Agentic and GenAI Data Security), MITRE ATLAS and ATT&CK, CWE, the NIST AI 600-1 GenAI profile, the NIST AI RMF, CSA's AI Controls Matrix and AIVSS — with machine-readable versions included. One clarification, since the misconception circulates: ISO/IEC 42001 is not among the official mappings. The connection can be made, though, and making it is our trade: the Top 10 is a threat catalogue ready to feed the risk assessment of an AI management system. Concretely, three immediate uses even for an SME:

• Vendor due diligence — if you buy software with an LLM inside, the ten entries are the questions to ask the vendor: how do you handle prompt injection? What can the model do on its own (Excessive Agency)? What happens to our data (Sensitive Information Disclosure)?
• Risk assessment input — for anyone building an ISO/IEC 42001 AIMS or preparing for AI Act obligations, the list is an authoritative, current threat catalogue from which to derive risk scenarios, with NIST/MITRE mappings ready for those with existing frameworks.
• A common language — the LLM01–LLM10 codes give management, developers and security vendors a shared vocabulary, as the web OWASP Top 10 has done for twenty years.

The right question

The real novelty of 2026 is not the ranking: it is the method, and the transparency about where belief and evidence disagree. The posture that follows applies to any organisation using LLMs: the question is not "is the model secure?" — that answer is already written, and it is no. The question is: what happens in your organisation the day the model is fooled?If the answer is "nothing important breaks", you have done governance. Everything else is hope.

Sources

• OWASP GenAI Security Project — OWASP GenAI LLM Top 10 2026 (August 4, 2026)
• Canonical repository — list, preface and Markdown sources
• 2026 Preface (methodology and quotations)
• Appendix A — Related Framework Mappings