Published: 2026-09-04
Categories: AI Governance and Compliance
Key Takeaways
The OWASP GenAI Security Project published the 2026 edition of its Top 10 for LLM Applications on August 3, 2026 [12], and formally unveiled it alongside a newly donated Agent Control Standard (ACS) and a slate of new sponsors on September 1-2, 2026, as the project’s community surpassed 30,000 members [1][2]. Excessive Agency moved from sixth to third place in the ranking, a rise that ReversingLabs, Check Point, and Superblocks each independently describe as the largest upward move in the 2026 list [4][5][11], reflecting a methodology that for the first time weighted analysis of 6,639 documented real-world incidents at 25% alongside 75% expert-practitioner consensus [3]. System Prompt Leakage was retired and replaced by the broader Hidden Context Exposure category, acknowledging that retrieved documents, agent memory, tool responses, and application state now carry as much confidentiality risk as the system prompt itself [5]. The Agent Control Standard is a separate, complementary specification: an open framework for runtime enforcement that gives enterprises declarative hooks, policy enforcement points, and an Agent Bill of Materials (AgBOM) to inspect, trace, and instrument autonomous agents in production [2][6]. Together, the ranking shift and the new standard signal that the industry’s compliance baseline for agentic AI is moving from a checklist of prompt-level risks toward continuous, machine-readable control over what agents are actually permitted to do at runtime.
Background
The OWASP Top 10 for LLM Applications has functioned as the de facto reference taxonomy for generative AI application security since its first release, and its periodic updates are treated by many enterprise security programs as a proxy for “what AI risk currently matters most.” The 2026 edition, published under the OWASP GenAI Security Project, surpassed 10,000 downloads within 48 hours of release and incorporated contributions from hundreds of AI security experts [1][2]. What distinguishes this edition from prior versions is methodology: project leadership introduced a hybrid scoring model that combines practitioner voting (75% weight) with empirical evidence drawn from 6,639 real incidents sourced from public vulnerability databases and an AI-harm database (25% weight) [3]. Steve Wilson, the Top 10 project founder, framed the update as “testing community expertise against thousands of real-world incidents,” while project chair Scott Clinton noted that generative AI security has “moved incredibly quickly from an emerging concern to an operational priority” [2].
The resulting ranking retains Prompt Injection at #1 and Sensitive Information Disclosure at #2, but Excessive Agency jumps three places to #3, and Misinformation rises from #9 to #7 [4][5]. System Prompt Leakage, a category that previously focused narrowly on protecting the literal system prompt text, has been retired in favor of Hidden Context Exposure at #8, a category that also captures retrieved documents, memory, user information, application state, and tool responses as attack surface [5]. The complete 2026 ranking is LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Excessive Agency, LLM04 Supply Chain, LLM05 Data and Model Poisoning, LLM06 Unbounded Consumption, LLM07 Misinformation, LLM08 Hidden Context Exposure, LLM09 Vector and Embedding Weaknesses, and LLM10 Improper Output Handling [4][11]. The 2026 release also expands cross-references to NIST, MITRE ATLAS, and CWE, and formally cross-links to the OWASP Top 10 for Agentic Applications, a companion list published in December 2025 that catalogs ten agent-specific risk categories (ASI01 through ASI10) covering goal hijacking, tool misuse, identity and privilege abuse, and cascading multi-agent failures [7].
Alongside the Top 10 refresh, the GenAI Security Project announced that the Agent Control Standard has been donated to the project as a new initiative [2][6]. Distinct from a risk taxonomy, ACS is a technical specification for runtime governance of AI agents: it defines an Agent Control System through which observed agents interact with “guardian agent” enforcement points, an observability layer that traces agent events via OpenTelemetry and the Open Cybersecurity Schema Framework (OCSF), and an Agent Bill of Materials that exposes an agent’s tools, models, and accessible data through the CycloneDX, SWID, and SPDX component-inventory formats [6]. The project describes ACS’s purpose in terms of three properties an agent must have to be considered trustworthy: it must be inspectable, traceable, and instrumentable, so that an operator can determine what an agent did and why after the fact, and constrain what it is allowed to do beforehand [6]. The specification is currently at version 0.1, covering core definitions, with implementation of instrumentation and reference “guardian agent” samples targeted for v1, full AgBOM component-format support via CycloneDX, SPDX, and SWID mapper implementations planned for v2, and expanded protocol support for deny and modify enforcement actions across A2A and MCP planned for v3 [6]. The project simultaneously released an AI Security Solutions Directory mapping vendors across generative, agentic, and red-teaming security categories, and a GenAI Security Industry Framework Crosswalk connecting OWASP guidance to other established compliance frameworks, alongside new Gold sponsors F5 and WitnessAI and Silver sponsors Evoke Security and Mondoo [1][2].
Security Analysis
In CSA’s assessment, the elevation of Excessive Agency is the most consequential change for enterprise security programs, because the incident-weighted methodology behind it gives the shift more evidentiary weight than a typical annual reshuffling of expert opinion alone. Excessive Agency describes the class of failures in which an LLM-based system is granted more autonomy, permissions, or unsupervised reach than the task requires, so that when the model is manipulated or simply makes a mistake, the resulting action has real-world consequences beyond generating incorrect text. ReversingLabs’ analysis of the 2026 list characterizes this as the “biggest move in the ranking” and connects it directly to the proliferation of agentic deployments that can call APIs, execute code, and modify production systems without a human confirming each step [4]. Check Point’s reading of the update reaches a similar conclusion: “more capability also creates more potential impact when a system is manipulated,” and the rise reflects incidents where agentic tool access, rather than the underlying model’s raw output, was the proximate cause of harm [5]. This finding is consistent with the pattern CSA has already documented in its analysis of OWASP’s separate “State of Agentic AI Security and Governance” v2.01 report, which found that prompt injection maps to six of ten agentic risk categories and functions as the near-universal delivery mechanism, while the resulting damage is almost always mediated by whatever permissions the injected agent happens to hold [8].
The retirement of System Prompt Leakage in favor of Hidden Context Exposure reflects a parallel maturation in how the security community understands confidentiality risk in LLM systems. Early guidance treated the system prompt as the primary secret worth protecting, on the theory that it might contain proprietary instructions, business logic, or safety guardrails an attacker could extract and circumvent. The 2026 category broadens that concern to any non-user-facing content flowing through the system: retrieved documents in a retrieval-augmented generation pipeline, conversational memory carried across sessions, upstream tool responses, and internal application state [5]. This broadens the relevant scope for security architects, because it means confidentiality controls designed around a single, static system prompt no longer cover the actual attack surface; a memory store, a vector index, or a chained tool response can each leak information just as damagingly as the original prompt text could.
The Agent Control Standard is best understood as the enforcement-layer counterpart to the risk taxonomy the Top 10 provides. Where the Top 10 tells a security team what can go wrong, ACS is an attempt to standardize how an enterprise actually stops or constrains an agent once that risk is identified, and to do so in a way that is portable across the fragmented landscape of agent frameworks (LangGraph, CrewAI, AutoGen, and similar orchestration layers) rather than requiring a bespoke integration for each one. The AgBOM component in particular addresses a gap CSA has flagged repeatedly in its own agentic AI research: without a standardized, machine-readable inventory of what tools, models, and data an agent can reach, most organizations cannot answer basic questions about their own agent population, let alone enforce policy against it. Because ACS is still at specification version 0.1 with implementation samples not yet released, enterprises should treat it as an architecture to plan around and pilot against rather than a control they can deploy today; its practical value will depend heavily on whether major agent framework and platform vendors adopt the specification, a question that is not yet resolved given how early the donation is.
Recommendations
Immediate Actions
Security teams should re-baseline their current LLM and agent risk registers against the updated 2026 ranking, paying particular attention to any control gaps around Excessive Agency, since a #6-to-#3 jump backed by incident data is a strong signal that permission scope, not just prompt hygiene, deserves renewed executive attention. Teams that built confidentiality controls narrowly around system prompt protection should audit whether those controls extend to retrieved documents, agent memory, and tool response content now captured under Hidden Context Exposure, closing any gap before it becomes an audit finding. Organizations already running or piloting agentic AI systems should begin an inventory exercise mapping each deployed agent to the tools, data sources, and downstream systems it can reach, which is a practical precursor to any future AgBOM adoption and independently useful for existing governance obligations.
Short-Term Mitigations
Enterprises should evaluate the Agent Control Standard’s architecture, even at v0.1, as a design reference for internal runtime governance requirements, since its emphasis on inspectability, traceability, and instrumentability maps closely to controls many organizations already owe under existing AI governance policy. Teams should require that any new agent framework or platform under procurement evaluation publish a roadmap for OpenTelemetry/OCSF-based event tracing and component inventory (CycloneDX, SWID, or SPDX) so that ACS compatibility does not become a retrofit exercise later. Where the organization already has tool-permission scoping in place for MCP-connected or API-calling agents, teams should validate that scope enforcement happens at invocation time rather than only at initial configuration, since permission accretion without periodic review is a commonly cited contributor to excessive-agency incidents.
Strategic Considerations
Governance and risk leadership should treat the pairing of an incident-weighted risk taxonomy with a runtime enforcement standard as an early indicator of where regulatory and audit expectations are heading: away from point-in-time attestations that an LLM application was reviewed against a risk list, and toward continuous, evidenced control over what autonomous systems are actually doing in production. CISOs should begin engaging now with the ACS specification’s evolution through v1, particularly its guardian-agent enforcement model, since organizations that shape early adoption decisions are likely to have more influence over how the standard matures than those that wait for a finished v1 release. Finally, because the Top 10’s incident-weighted methodology is itself new, security leaders should expect further ranking volatility in future editions as more incident data accumulates, and should build governance programs around the underlying risk categories rather than around this year’s specific rank ordering.
CSA Resource Alignment
CSA’s own research on OWASP’s parallel agentic AI governance work provides the most direct grounding for this update. “OWASP’s Agentic AI Maturity Model: A CISO Guide” analyzes the OWASP GenAI Security Project’s “State of Agentic AI Security and Governance” v2.01 report and its two-dimensional Enterprise Adoption Maturity Model, which scores organizations across nine Adoption Tiers (AT0 through AT8) and five Governance Maturity levels [8]. That framework is directly applicable here: the Excessive Agency risk elevated in the 2026 Top 10 is precisely the failure mode the Adoption Tier axis is designed to bound, and organizations using CSA’s guide to classify their agent population by tier now have a ready-made way to prioritize which agents most urgently need the tool-permission controls this update recommends.
CSA’s “Agentic MCP Security Best Practices Guide” addresses the runtime enforcement layer that the Agent Control Standard is attempting to standardize industry-wide, covering tool-level permission scoping, least-privilege service account provisioning, and per-invocation authorization controls for agents connected through the Model Context Protocol [9]. Security teams evaluating how to operationalize ACS’s guardian-agent and policy-enforcement concepts can use this guide’s existing controls as an interim implementation while the ACS specification itself matures past v0.1.
Finally, CSA’s AI Controls Matrix (AICM) v1.1 remains the appropriate governance backbone for translating both the updated Top 10 and the Agent Control Standard into an auditable control set. AICM v1.1 delivers 247 control objectives across 18 domains, including identity and access management and threat and vulnerability management domains directly relevant to excessive-agency and hidden-context-exposure risk, with pre-built mappings to ISO 42001, ISO 27001, and other major AI governance frameworks [10]. Enterprises building or updating an LLM and agentic AI compliance program should treat AICM v1.1 as the control framework of record, with the OWASP Top 10 categories and ACS’s runtime enforcement model informing which specific AICM controls warrant the most immediate implementation effort.
References
[1] OWASP GenAI Security Project. “OWASP GenAI Security Project Unveils 2026 Top 10 for LLM Applications, New Agent Control Standard and Sponsors as Community Tops 30,000 Members.” OWASP GenAI Security Project, September 1, 2026.
[2] OWASP GenAI Security Project. “OWASP GenAI Security Project Releases 2026 Top 10 for LLM Applications, Debuts Agent Control Standard and New Resources for Securing Generative and Agentic AI.” PR Newswire, September 2026.
[3] Help Net Security. “OWASP 2026 LLM Top 10: “The model will be fooled”.” Help Net Security, August 6, 2026.
[4] ReversingLabs. “OWASP Top 10 for LLM Apps 2026: Excessive agency risk on the rise.” ReversingLabs Blog, 2026.
[5] Check Point. “Reading the Signals in the OWASP LLM Top 10 2026.” Check Point Blog, 2026.
[6] GenAI Security Project. “agent-control-standard: The open standard for runtime agent control.” GitHub, 2026.
[7] OWASP GenAI Security Project. “OWASP GenAI Security Project Releases Top 10 Risks and Mitigations for Agentic AI Security.” OWASP GenAI Security Project, December 9, 2025.
[8] Cloud Security Alliance AI Safety Initiative. “OWASP’s Agentic AI Maturity Model: A CISO Guide.” Cloud Security Alliance, July 3, 2026.
[9] Cloud Security Alliance AI Safety Initiative. “Agentic MCP Security Best Practices Guide.” Cloud Security Alliance, March 27, 2026.
[10] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” Cloud Security Alliance, June 22, 2026.
[11] Superblocks. “OWASP LLM Top 10 2026: The Full List and What Changed.” Superblocks Blog, 2026.
[12] OWASP GenAI Security Project. “OWASP GenAI LLM Top 10 2026.” OWASP GenAI Security Project, August 3, 2026.