OWASP Ranks Prompt Injection the No. 1 AI Threat for Third Year Running. Real-World Incident Data Puts It at No. 12.

Prompt injection has topped the OWASP Top 10 for LLM Applications for three years straight. The nonprofit's community-driven list, now in its third version, was published August 4, 2026, and once again security practitioners voted it the number one risk from generative AI tools, according to Infosecurity Magazine.

When two leaders of that same OWASP project checked the ranking against real-world incident data, prompt injection came in at No. 12, not No. 1. That analysis, published on arXiv on August 18 by Kyriakos "Rock" Lambros and Steve Wilson, pulled from 7,714 documented LLM security incidents across CVE, GitHub Security Advisories, OSV, and the AIAAIC AI-harm database, with 6,639 of them labeled against a 20-entry taxonomy, according to VentureBeat.

The two numbers don't agree, and the authors say that's significant. Cohen's kappa, the statistical measure of agreement between the expert vote and the incident record, came in at 0.20, with a 90% confidence interval running from negative 0.16 to 0.57. Because that interval crosses zero, Lambros and Wilson write, "we cannot rule out that the two rankings agree only by chance." Their own conclusion: "weak agreement, not confirmation."

Lambros, who co-leads the OWASP GenAI Security Project Top 10 for LLM Applications and serves as director of AI standards and governance at Zenity, framed it for VentureBeat as a credibility problem, not a data problem. "We had two ways of measuring the same risk, expert judgment and the public incident record, and they disagree with each other. Neither one is the truth," he said. "Two witnesses are contradicting each other, and we can't tell you which one is lying."

Why the Scanner Can't See It

The mismatch has a structural explanation, and it's not that practitioners are paranoid. Prompt injection works by hiding instructions inside content a model reads: a log entry, a support ticket, a document pulled back through retrieval. The AI agent then executes an action the attacker wanted, using credentials it already legitimately holds.

Nothing in that chain is a software defect. There's no faulty code for a vulnerability scanner to flag, no CVE to file. The attack exploits how the system is designed to work, not a bug in how it's built. That's why it barely registers in the public incident record while remaining, in the judgment of the people who build and defend these systems, the most dangerous thing on the list.

OWASP's own report makes this case directly, according to Infosecurity Magazine: "Teams fight injection hard, so fewer clean exploits reach a public database, and the public count understates the risk that mature teams already spend real money holding off." In plain terms, the absence of visible incidents may reflect successful defense rather than absent threat, an interpretation OWASP offers but that Lambros and Wilson's own statistical analysis says the data can't actually confirm one way or the other.

A skeptic could reasonably ask whether OWASP is rationalizing a ranking the numbers don't support, essentially explaining away inconvenient data rather than confronting it. Lambros and Wilson's own honesty about the weak statistical agreement, publishing a paper that undercuts their own project's flagship list, suggests otherwise. They're naming the gap and admitting neither dataset settles the question.

What OWASP Says To Do About It

The recommended fix isn't a patch. OWASP's guidance, per Infosecurity Magazine, is to design systems assuming the model's instruction boundary will eventually be broken, then hard-limit what the model is allowed to do and where its outputs can go. Wilson, Chief AI and Product Officer at Exabeam and OWASP project co-lead, pointed VentureBeat to a specific failure mode as his top priority: an agent reading an attacker's payload in a log file, treating it as an instruction, and rewriting DNS records using a valid credential it already holds.

The rest of the 2026 list shifted too. Sensitive information disclosure held the No. 2 spot for a second straight year, and unlike prompt injection, OWASP found practitioner concern and incident data line up closely there, according to Infosecurity Magazine. Excessive agency, the risk of AI systems taking damaging actions on ambiguous or manipulated input, jumped from sixth to third place.

Chris Hughes, writing at resilientcyber.io, connects this to a broader argument he's been making for months: the danger isn't in the model's weights, it's in the "harness" around it, meaning the internet access, tool permissions, and autonomy an agent is granted in production. Hughes points to the same conclusion OWASP's own project leads reached: the debate over which model or vendor to trust is largely beside the point if the surrounding system hands that model a blank check.

Lambros and Wilson are explicit that their arXiv analysis is exploratory, not peer-reviewed, and doesn't replace OWASP's official process or ranking. The open question their paper leaves on the table is procedural. If incident data and practitioner judgment keep disagreeing at this scale, what changes about how OWASP builds next year's list, and does the industry keep funding defenses against a threat category that a vulnerability scanner will never be able to prove is working.