OWASP moves excessive agency from sixth to third in 2026
Prompt injection stays first, and incident records give 25% of the weight.
The OWASP GenAI Security Project released its 2026 Top 10 for large language model apps. Excessive agency moves from sixth to third. It is the risk of too many permissions or too much control for an AI app. Prompt injection stays first. Votes from experts give 75% of the weight.
Sources
Posted
