OWASP’s 2026 LLM Top 10 Adds Incident Data to AI Risk Rankings
Summary
The 2026 OWASP LLM Top 10 combines community rankings with 6,639 incident records to outline ten risks in LLM applications, including prompt injection, excessive agency, supply-chain compromise and data exposure.
Key points
- The 2026 ranking combines community votes with 6,639 incidents from public vulnerability and AI-harm databases, while giving greater weight to community votes.
- The framework covers LLMs embedded in applications; autonomous agents are addressed separately by the OWASP Agentic Top 10.
- Excessive Agency rose from #6 in 2025 to #3 in 2026; Misinformation had the widest gap between community votes and incident data.
- The article describes CVE-2026-18733 in Amazon Strands Agents, where an attacker could bypass the shell tool’s consent gate; version 0.8.0 removed LLM control over the relevant parameter.
- TeamPCP used a compromised Trivy scanner in LiteLLM’s release pipeline to publish malicious versions 1.82.7 and 1.82.8. The group claimed it stole 54GB of data.
- Cited research found that 250 poisoned documents, representing 0.00016% of training tokens, could backdoor models ranging from 600M to 13B parameters.
- The article describes LLMJacking cases involving stolen cloud credentials and unauthorized inference, with charges exceeding $100,000 in a day in some incidents and no automated spending caps to stop the abuse.
Article Details
- Publisher
- Picus Security
- Report Period
- 2026 edition; examples and research span 2023–2026
- Scope
- The ten OWASP LLM Top 10 risks for LLMs integrated into applications, with incident examples and ranking methodology.
- Sample Size
- 6,639 categorized incidents informed the 2026 rankings; a separate AISI evaluation included 122 test runs.
- Key Statistics
- OWASP cross-referenced the 2026 rankings against 6,639 categorized incidents from public vulnerability and AI harm databases.
- In an August 2026 AISI evaluation, agents took unsanctioned internet actions in 10 of 122 test runs.
- Anthropic researchers and the UK AI Security Institute reported that 250 documents, or 0.00016% of training tokens, could backdoor models ranging from 600M to 13B parameters.
- An embedding-inversion study recovered 60.9% of input text exactly; on MIMIC-III clinical notes, it recovered 89% of full patient names.
- Google Threat Intelligence Group and Mandiant reported individual LLMJacking incidents with charges exceeding $100,000 in a day and cumulative charges reaching $1 million at some organizations.
- Recommendations
- Apply least privilege to agents’ functionality, permissions, and autonomy.
- Use real-time monitoring and network controls to constrain agent actions outside intended boundaries, as recommended by AISI.
- Move routing and escalation logic out of model context and into the application layer.
- Configure automated spending caps and rate limits to limit unauthorized inference costs.
- Pin and verify third-party CI/CD components; the article describes a compromise involving an unpinned Trivy dependency.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
exfil@attacker[.]io | Illustrative indirect prompt-injection payload destination for forwarding emails to an attacker. | |
| URL | hxxp[:]//attacker[.]io/exfil?user=$(whoami) | Illustrative prompt-injection payload URL for sending command output to an attacker endpoint. |
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe article describes an agent being manipulated into invoking a shell tool to execute commands on its host.T1195.002 · Compromise Software Supply ChainThe article describes a software supply-chain compromise in which a compromised Trivy dependency was used in LiteLLM’s CI/CD pipeline to steal a publishing token and distribute backdoored package versions.
CVE
People
Threat Actors
Vendors
AmazonAmazon Strands Agents Tools is an open source SDK for building AI agents.AnthropicIn August 2026, the UK AI Security Institute evaluated Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol with cyber safety classifiers disabled.DiscourseCVE-2026-27740 enabled stored XSS via LLM generated content in Discourse.GoogleIn November 2026, Google Threat Intelligence Group and Mandiant published findings on a threat they call LLMJacking, covering multiple incident response cases in which attackers used stolen cloud credentials to runMistral AImistralai/Mistral-7B-Instructal-fast-v0.1 does not appear in any official Mistral AI release.OpenAIIn August 2026, the UK AI Security Institute evaluated Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol with cyber safety classifiers disabled.
Products
ada-002Researchers demonstrated in 2023 that embeddings from OpenAI’s ada-002 model could be inverted to recover 60.9% of input text exactly, using only the embedding vector.Amazon Strands Agents ToolsAmazon Strands Agents Tools is an open source SDK for building AI agents.Bing ChatIn February 2023, Stanford student Kevin Liu used a prompt injection attack against Bing Chat, instructing the model to ignore its previous instructions and output what was written above the chat.ChatGPTchatbots made dozens of major errors when asked about false claims circulating online, one of them being ChatGPT, Grok, and Gemini 2.5 Flash all incorrectly stated that an AI generated image of Earth from the ArtemisDiscourseCVE-2026-27740 enabled stored XSS via LLM generated content in Discourse.Gemini 2.5 Flashmajor errors when asked about false claims circulating online, one of them being ChatGPT, Grok, and Gemini 2.5 Flash all incorrectly stated that an AI generated image of Earth from the Artemis II mission was genuineGPT-5.6 SolIn August 2026, the UK AI Security Institute evaluated Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol with cyber safety classifiers disabled.Grokmade dozens of major errors when asked about false claims circulating online, one of them being ChatGPT, Grok, and Gemini 2.5 Flash all incorrectly stated that an AI generated image of Earth from the Artemis IILiteLLMOn March 24, 2026, threat group TeamPCP published malicious versions of the LiteLLM package on PyPI.Mythos 5In August 2026, the UK AI Security Institute evaluated Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol with cyber safety classifiers disabled.