Immediate injection ranks No. 1 with OWASP and No. 12 in the incident document. The assault itself is invisible to a scan.

A CISO who sees a low CVE depend and deprioritizes immediate injection is studying the scoreboard incorrect. Immediate injection has held the No. 1 spot on the OWASP Prime 10 for LLM Functions for three consecutive years. When two leaders of that record checked it in opposition to 6,639 labeled real-world incidents, it got here again at No. 12. The drop measures visibility fairly than hazard, as a result of the assault operates the place a vulnerability scanner can not see it.

That discovering belongs to Kyriakos “Rock” Lambros and Steve Wilson, two leaders of the OWASP Top 10 for LLM Applications project, who published it on arXiv on August 18 with the disclaimer connected. The evaluation is exploratory, not peer reviewed, and not the official OWASP launch, and the authors state it does not supersede the official record or its course of.

The equipment behind it is actual: 7,714 LLM safety incidents from CVE, GitHub Safety Advisories, OSV, and the AIAAIC AI-harm database, 6,639 of them labeled in opposition to a 20-entry taxonomy, and a Bayesian mannequin that corrects every depend for classifier error before setting the data-driven rating beside the skilled vote.

The comparability discovered no statistically detectable settlement between skilled judgment and the public incident document. Cohen’s kappa is available in at 0.20 with a 90% interval working from destructive 0.16 to 0.57. “The interval crosses zero, so we can not rule out that the two rankings agree solely by probability,” they write. “The sincere backside line: weak settlement, not affirmation.”

Lambros, co-lead of the OWASP GenAI Safety Challenge Prime 10 for LLM Functions and director of AI requirements and governance at Zenity, put the discovering in evidentiary phrases in written solutions to VentureBeat. “We had two methods of measuring the identical threat, skilled judgment and the public incident document, and so they disagree with one another. Neither one is the reality,” Lambros stated. “Two witnesses are contradicting one another, and we are able to’t let you know which one is mendacity.”

The assault chain a scanner by no means logs

The hole is structural. Immediate injection hides directions inside the content material a mannequin reads, something from a log entry to a assist ticket to a doc pulled again by retrieval. The agent then makes the instrument name the attacker wished, utilizing credentials it legitimately holds. Nothing in that chain is a product defect, so the assault leaves no CVE behind for a scanner to discover.

The defenses that catch it are adversarial checks in opposition to the deployed system and arduous caps on what the agent can attain, so a fooled mannequin can not contact something costly. The identical logic argues for funding agent reminiscence and MCP instrument boundaries now, on structure, fairly than ready for advisory quantity that can all the time arrive a cycle late.

The primary management Wilson would deploy

Wilson, Chief AI and Product Officer at Exabeam and undertaking co-lead for the OWASP Prime 10 for LLM Functions, named the management he would deploy first in opposition to precisely that chain, an agent that reads an attacker’s payload in a log file, treats it as an instruction, and rewrites DNS with a legitimate credential, in written responses to VentureBeat.

“The very first thing I’d do is put an authorization gate exterior the mannequin: the agent can suggest the actual DNS change, but it surely can not grant itself the authority to make it,” Wilson stated. “Safety guidelines written inside prompts might form the mannequin’s conduct, however they are nonetheless options to the mannequin, not enforceable safety controls.”

The gate has a value, and Wilson states it plainly. “The tradeoff is that the agent loses the potential to improvise arbitrary, high-impact infrastructure adjustments on its personal, whereas retaining autonomous investigation and routine, bounded remediation,” he stated.

Why the No. 1 threat appears small in the document

“Immediate injection is the best-understood LLM assault, and deployed methods defend in opposition to it actively,” the authors write, and so they compress the complete divergence into one sentence. “Specialists rank it first as a result of the assault floor stays monumental even when the defenses principally maintain; the knowledge sees the successes that bought by.”

Wilson has watched the hole from each side of it. “Incident knowledge is extremely precious, but it surely is inherently backward-looking and notoriously tough to interpret,” he stated. “It tells us what was noticed, acknowledged, labeled, and reported. It does not essentially inform us what is most harmful in the methods folks are constructing proper now.”

He compares immediate injection to “dying and taxes” and, more and more, to “a regulation of physics for LLM methods,” as a result of one mannequin is being requested to interpret trusted directions and untrusted content material at the identical time.

Higher defenses have not closed the case. “A management that works 99% of the time is not adequate when the failure case provides an attacker significant entry. And, frankly, I don’t suppose we are at 99%,” Wilson stated. “The sturdy reply is not believing we are able to completely display immediate injection out of existence. It is designing methods with the assumption that immediate injection will happen, understanding why it really works, and limiting what an attacker can accomplish when it does.”

A low advisory depend can imply the defenses are working. It will possibly simply as simply imply no person has seemed, and the public document can not inform a safety staff which one it is.

The try quantity is documented. CrowdStrike’s 2026 Global Threat Report discovered adversaries injected malicious prompts into respectable GenAI instruments at greater than 90 organizations in 2025, stealing credentials and cryptocurrency, below a bit titled “Prompts are the New Malware.” The telemetry exhibits strain on the assault floor with out proving defenses produced the No. 12 placement, but it surely is the sample the mechanism predicts.

The hole runs the different method too, and additional

Immediate injection is the headline case, and misinformation is the larger one.

The skilled vote places misinformation at No. 13, whereas the incident document locations it at No. 2. The paper calls it “the widest disagreement between the two witnesses” and experiences that its concordance flag “places the chance that the two alerts disagree at 99 %.”

The authors do not deal with their very own knowledge as the winner. On misinformation they notice the corpus “carries a big quantity of deepfake and AI-generated disinformation,” information that always “describe hurt produced by an AI fairly than a vulnerability inside an LLM.” The authors name it the entry the document most disputes, stopping in need of concluding the specialists bought it incorrect.

The place “too new to measure” runs into the CVE document

The 2 brand-new taxonomy entries sit at the sharpest finish. Persistent reminiscence poisoning lands at skilled No. 4 and incident No. 16, MCP instrument interface exploitation at skilled No. 7 and incident No. 16, every with an incident interval of 6 to 20 that spans most of the taxonomy.

Public 2026 CVEs exist for each. On MCP instrument interfaces, the Azure Information Explorer MCP Server carried KQL injection, and the CVE document describes it permitting “an attacker (or a prompt-injected AI agent) to execute arbitrary KQL queries in opposition to the Azure Information Explorer cluster,” scored 8.3 High. Kong’s Konnect MCP Server shipped an indirect prompt injection that lets a distant attacker steer the server into executing unintended API requests, the actual failure the MCP entry names.

Agent reminiscence has its personal document. An agent harness, Ruflo, uncovered unauthenticated MCP bridge endpoints that permit a community attacker acquire a shell, learn supplier API keys, and poison the studying retailer, rated 10.0 Critical.

The document is so skinny and unsure that the mannequin can not place both entry inside 14 rank positions. A staff ready for advisory quantity to justify a management on agent reminiscence or an MCP instrument boundary would nonetheless be ready whereas the CVEs accumulate at Essential and Excessive.

Lambros makes the price range case in operational phrases. Poisoned reminiscence “doesn’t announce itself,” he stated. It appears like a procurement agent instructed as soon as that invoices from a given provider below $50,000 clear with out a second signature, and since the agent remembers, each approval after that appears like the course of working. “No one information an advisory for that, as a result of no person is aware of it occurred. A depend of zero is measuring your blindness, not your security.” The argument he says a CFO will log off on is timing, since reminiscence and gear permissions get wired into these methods as soon as, early, and every thing else sits on prime of them. “Construct it in now and it’s a rounding error. Come again in two years and also you’re re-architecting and re-training your methods.”

The authors flag their very own measurement issues first

The skilled facet is skinny. “The skilled sign is a practitioner survey: about 29 respondents scored every candidate threat on significance,” the authors write. Twenty-nine votes set the rating that carries three-quarters of the revealed record’s weight, the compression level for OWASP’s more than 25,000 community members.

On the knowledge facet, the classifier is the weak joint. Precision “varies sharply throughout entries, from 93% (LLM01, LLM03) down to 13% (LLM08),” 4 entries fall beneath 50%, and the base classifier “by no means predicts ‘out of scope’ and information each incident into some class, together with the roughly 38% of the gold set that belongs in none.”

The authors title the central limitation themselves. One reviewer adjudicated all 1,200 gold-set incidents and overrode the mannequin consensus on 553 of them. “A single annotator can not measure inter-rater reliability,” they write. “The only-author gold set stays the central limitation.”

Lambros lays the weak kappa at the toes of the taxonomy itself. “That quantity is telling you about our classes, not about our specialists,” he stated. When the individuals who wrote a taxonomy can not reliably type incidents into it, he argues, “a weak rating on the ordering of these buckets is a truth about the buckets.”

A greater classifier will not repair the disagreement. A pre-registered bake-off of 4 frontier fashions produced no winner. None beat the incidence ground’s balanced accuracy of 0.863, and a ground-truth test left the ground’s ordering in place at a Spearman correlation of 0.918. The authors revealed the engine and artifacts on GitHub for anybody to rerun.

The robustness end result examined just one facet of the hole. Each test behind the summary’s phrase “sturdy” runs on the incident facet, displaying the incident-derived rating stays put when the labeling equipment adjustments, and none of it touches the 29-vote survey. A board that hears “sturdy” will assume validated, but the document helps solely steady.

What the revealed record did with this

OWASP shipped the GenAI LLM Top 10 2026 on August 4, the first version to fold incident knowledge into the rating, weighting the practitioner vote at 75% and the incident corpus at 25%. Immediate injection stayed at No. 1, misinformation moved up two locations, extreme company climbed from No. 6 to No. 3 as the entry the place the two alerts agree most clearly, unbounded consumption rose four spots to No. 6, and improper output dealing with fell from No. 5 to No. 10, the largest drop.

Wilson declines to defend the mix as arithmetic. “There is nothing magical a few 75/25 weighting,” he stated, “or about reversing it to 25/75. The worth of the knowledge wasn’t that it gave us a mathematical reply; it modified the dialog.” The extreme company entry is the place that dialog landed hardest for him. “If I have been a CISO evaluating a brand new agentic deployment at this time, Extreme Company is the place I might begin,” Wilson stated.

Lambros would go additional subsequent cycle, a view he flags as his personal and separate from the working group. The mix fingers the identical 25% incident weight to each class, whereas the hand-checked classifier precision runs from roughly 9 in 10 on immediate injection and provide chain down to roughly one in eight on vector and embedding weaknesses. 1 / 4 of the weight on the first rides on one thing stable, he argues, and the identical quarter on the second rides on noise. “The ratio ought to monitor how nicely we really measure every class,” Lambros stated.

Why this lands now

Ivanti’s 2026 State of Cybersecurity research discovered 87% of safety groups name adopting agentic AI a precedence and 77% report no less than some consolation letting AI act with out human evaluate. Groups are signing off on agent autonomy whereas the skilled rating of what can go incorrect with these brokers exhibits no statistically detectable settlement with the incident document.

What to do with this on Monday

The behavioral change is slender and it is the complete level.

• Use the OWASP LLM Prime 10 as a protection map, not a queue. The rank positions carry 29 votes and a corpus whose personal authors name the settlement weak, so construct your personal precedence order from your personal publicity: manufacturing attain, breach-notification knowledge, and controls which have really been examined. Lambros attracts the funding line the identical method. “I’d prioritize spend the place the skilled vote and the incident document level the identical course, as a result of that’s two impartial witnesses agreeing,” he stated. “The place they break up, cease letting the rating allocate your cash and go have a look at what your personal methods are doing.”

• Log what your AI methods are really doing, subject by subject. The immediate that went in, what got here again out, the paperwork pulled to construct the reply, the instruments referred to as and the arguments handed to them, and the mannequin’s confidence rating on each response. Confidence is the subject Lambros would battle for, as a result of most safety leaders do not notice it is measurable, and it is the place the assault surfaces. “A mannequin working on a poisoned instruction doesn’t act damaged. It acts sure,” he stated. “Certainty is what your monitoring treats as a wholesome system.” The price is a dash or two of engineering. The constraint is an individual, as a result of a SIEM does occasions and these are traits. “Someone has to analyze these traits each week and say whether or not a drift means something, and most safety groups have no person who can.”

• Cease anticipating scanner output to reproduce the Prime 10’s order. Scanner findings dwell on the incident facet of the hole, counting what bought disclosed fairly than what a deployed system ought to concern, and the classifier bake-off exhibits a better mannequin does not shut that distance. The take a look at that sees immediate injection is an adversarial one run in opposition to the dwell system, paired with Wilson’s authorization gate so the change an injected agent proposes is by no means the change it could actually execute.

• Fund the thin-record classes on structure, not incident quantity. Agent reminiscence and MCP instrument boundaries sit at skilled No. 4 and No. 7 with incident intervals spanning most of the taxonomy, and the CVEs that do exist are touchdown at Excessive and Essential. Kayne McGladrey, an IEEE senior member who advises enterprises on threat, put the funding logic bluntly in an interview with VentureBeat. “Something that appears to have a cybersecurity taste is usually put into the cybersecurity threat class, which is an entire fiction,” McGladrey stated. “They need to be targeted on enterprise dangers, as a result of if it doesn’t have an effect on the enterprise, like a monetary loss, then no person’s going to listen to it, and they’re going to not price range it appropriately.” A rank quantity from a 29-person vote is a weaker price range argument than the enterprise system the agent touches.

• Steal McGladrey’s baseline take a look at for the AI methods themselves. “If you happen to wouldn’t expose your database to the public web with out id and entry controls, why would you do this in your AI mannequin?” he stated in CSO Online’s analysis of 2026 breach costs.

The board query for the subsequent assembly is brief. If our AI threat rating got here from a 29-person vote and a corpus that disagrees with it, what are we really utilizing to determine which controls get funded subsequent yr?