A CISO might misinterpret a low CVE count as a reason to downplay prompt injection, but this approach is flawed. For the past three years, prompt injection has topped the OWASP Top 10 for LLM Applications list. Yet, when two key figures from the list, Kyriakos “Rock” Lambros and Steve Wilson, compared it to real-world data from 6,639 incidents, its rank fell to 12th. This decrease reflects its invisibility rather than its threat level, as the attack occurs beyond the reach of vulnerability scanners.
Lambros and Wilson, leaders in the OWASP Top 10 for LLM Applications project, shared these findings on arXiv on August 18, stressing that this exploratory analysis is not peer-reviewed or an official OWASP release. It examines 7,714 LLM security incidents using a Bayesian model to correct for classifier errors and compare data-driven rankings with expert opinions.
The analysis highlights a lack of agreement between expert judgment and public incident records, with Cohen’s kappa at 0.20 and a 90% interval from -0.16 to 0.57. This suggests the rankings might align only by chance. Lambros explained the discrepancy in a statement to VentureBeat: “We had two ways of measuring the same risk, expert judgment and the public incident record, and they disagree with each other. Neither one is the truth.”
The attack chain a scanner never logs
Prompt injection is structurally elusive, embedding commands in the content a model processes, such as log entries or documents. The agent uses its legitimate credentials to enact the attacker’s desired tool call, leaving no CVE trace for scanners to detect. Effective defenses include adversarial tests and limiting agent access, suggesting investment in agent memory and MCP tool boundaries should be made proactively, not reactively.
The first control Wilson would deploy
Wilson, of Exabeam and the OWASP Top 10 for LLM Applications, advocates for an authorization gate to prevent agents from autonomously executing DNS changes. While prompts can influence model behavior, they do not enforce security. The tradeoff is reduced agent autonomy in infrastructure changes while maintaining limited investigative capabilities.
Why the No. 1 risk looks small in the record
Though prompt injection is well-defended against, its attack surface remains vast. Data records only successful breaches, not the potential danger. Wilson notes the backward-looking nature of incident data, which doesn’t reflect emerging threats. He likens prompt injection to unavoidable constants like “death and taxes.”
A low advisory count might indicate effective defenses or simply a lack of scrutiny. CrowdStrike’s 2026 Global Threat Report recorded numerous prompt injections in 2025, corroborating the expected attack pattern despite the low ranking.
The gap runs the other way too, and further
Prompt injection may be the headline, but misinformation is a more contentious issue. Experts rank it 13th, while incident records place it 2nd, with a 99% probability of disagreement. The authors note the data often reflects AI-generated disinformation rather than LLM vulnerabilities, questioning the expert assessment without dismissing it entirely.
Where “too new to measure” runs into the CVE record
New taxonomy entries like persistent memory poisoning and MCP tool interface exploitation show significant ranking disparities between experts and incidents. Public CVEs for these issues exist, but a lack of advisory volume might delay necessary controls. Lambros argues for early architectural investments to avoid costly future system overhauls.
The authors flag their own measurement problems first
The study’s limitations are acknowledged by the authors. With only 29 experts setting the rankings, the weight of their input is disproportionately large. The classifier’s precision varies widely, and a single reviewer’s annotations limit inter-rater reliability. Lambros attributes the weak kappa to the taxonomy rather than the experts.
Efforts to improve the classifier did not resolve the discrepancies. Despite testing, the incident-derived ranking remains stable, highlighting the need for cautious interpretation of “robust” results.
What the published list did with this
The GenAI LLM Top 10 2026 integrated incident data into its ranking for the first time, with a 75/25 weight favoring expert opinion. While prompt injection retained its top position, misinformation rose, and other categories shifted. Wilson emphasizes the value of changing the conversation over precise weighting.
Lambros suggests adjusting the incident weight based on measurement reliability, advocating for a more nuanced approach in future cycles.
Why this lands now
According to Ivanti’s 2026 State of Cybersecurity research, 87% of security teams prioritize agentic AI, with many comfortable with AI autonomy. However, this comes amid a misalignment between expert risk assessments and incident data.
What to do with this on Monday
The necessary shift in behavior is clear:
-
Use the OWASP LLM Top 10 as a coverage map, not a queue. Given the weak agreement between rankings and data, prioritize based on specific exposure and tested controls. Lambros advises focusing funds where expert and incident data align.
-
Log what your AI systems are actually doing, field by field. Monitor prompts, outputs, document retrievals, tool use, and model confidence. Lambros emphasizes the importance of tracking confidence as a sign of attack.
-
Stop expecting scanner output to reproduce the Top 10’s order. Scanners reflect disclosed incidents, not current system threats. Instead, conduct adversarial testing and implement authorization gates to prevent unauthorized agent actions.
-
Fund the thin-record categories on architecture, not incident volume. Prioritize architectural solutions for agent memory and MCP tool boundaries, as their criticality is evident despite sparse incident data.
-
Steal McGladrey’s baseline test for the AI systems themselves. Adopt a cautious approach similar to database security when considering AI model exposure.
As security boards evaluate risks, they must question the basis of their funding decisions, especially when relying on potentially flawed rankings.
