How the OWASP LLM Top 10 2026 Was Ranked
Vote vs Incident Record and the Defense Effect

In 30 seconds

• For 2026 the OWASP GenAI Security Project weighted its community vote against a record of real incidents for the first time.
• The evidence base: 7,714 real incidents pulled from public vulnerability databases and an AI-harm database; classifiers sorted the 6,639 that carried enough detail.
• Weighting is 75% vote, 25% incident data. A quarter weight can move an entry a tier where belief and evidence diverge widely, but it cannot rewrite the list.
• The defense effect: ranked by raw incident count, Prompt Injection falls out of the top 10 — yet it stays #1, because teams fight it so hard that clean public exploits are rarer than the underlying risk.
• The Misinformation gap runs the other way: voters ranked it low, the incident record ran high; it moved up from 9 to 7.
• Practitioner lesson: incident counts understate the risks teams already fight hardest. Do not deprioritize a control just because its public CVE count is low.

A new test: the incident record

Earlier editions of the list ranked risks primarily by a survey of practitioners — a structured way of asking the community what it was most worried about. That captures hard-won judgment, but a vote measures belief, not outcomes. It can lag a fast-moving field, and it can over- or under-weight a risk that is loud in conversation but quiet in the data (or the reverse).

The 2026 edition, described in the project leads' letter accompanying the release, adds a second signal. The team assembled 7,714 real incidents from public vulnerability databases and an AI-harm database. Not every record carried enough detail to categorize, so classifiers placed the 6,639 that did into the risk taxonomy. That gives each candidate entry a second reading: alongside what the community believes, there is now what the record shows.

Two readings only help if you decide in advance how much each one counts. OWASP did.

Why the vote still carries three-quarters

The weighting is 75% community vote, 25% incident data. That split is deliberate, and the reasoning is worth internalizing because it shapes every position on the list.

An incident record is a lagging, uneven signal. It reflects what got discovered, disclosed, and written up — which is a function of how much attention a class of failure receives, how easy it is to attribute, and how strongly defenders suppress it. It is not a clean census of real-world risk. The community vote, for all its subjectivity, folds in exposure that has not yet surfaced as a tidy, countable incident. Leaning on the vote keeps the list from chasing whatever happened to be easy to catalog in a given year.

A 25% weight is still meaningful. Where belief and evidence point the same way, it reinforces confidence. Where they diverge sharply, it is enough to move an entry a tier — nudging a risk up or down — without letting a noisy dataset overturn the collective judgment of the field. That balance is exactly what produced the two most instructive results on the 2026 list.

The defense effect: why Prompt Injection stays #1

Rank the candidates by raw incident count alone and Prompt Injection falls out of the top 10 entirely. Taken at face value, that reads like good news. It is the opposite.

Prompt injection is the risk teams fight hardest. Input filtering, output-schema validation, provenance labeling, human-in-the-loop on privileged actions, capability budgets — the surface is under constant, heavy defense. Heavy defense means clean, reportable exploits reach public databases less often, so the public count understates the real exposure. The underlying condition has not gone away: the untrusted-input surface can never be fully closed, because an LLM cannot reliably separate instructions from data when both arrive as one token stream. There is no reliable prevention today, a position consistent with NIST and NCSC guidance from 2025.

This is the defense effect: a low public incident count can be a signal of successful mitigation, not low risk. The community vote saw through it, the methodology preserved it, and Prompt Injection stays at LLM01 — now explicitly covering cross-modal (image and audio) attacks. If your program deprioritized injection because its CVE feed looked quiet, this is the year to reread the reasoning.

The Misinformation gap: evidence over belief

Misinformation runs the mirror-image pattern. Voters ranked it relatively low; the incident record ran high — the widest belief-versus-evidence gap OWASP flags in the harmful direction. Here the 25% weight did its job in the other direction, pulling the entry up from 9 to 7 (LLM07).

The lesson pairs with the defense effect. The same weighting that protects a well-defended risk from being underrated by the data also protects a genuinely widespread harm from being underrated by the vote. Belief and evidence are both partial; combining them, with the vote in the lead, catches what either would miss alone.

Where belief and evidence diverged

Four entries illustrate the full range — from perfect agreement to sharp divergence in both directions.

Sensitive Information Disclosure is the anchor case: the one top slot where vote and incident evidence agree outright, which is why OWASP describes it as the highest-confidence entry. Excessive Agency's move from 6 to 3 is the consequential one — belief and record both say agentic deployments are where prompt injection turns into real-world consequence, which is why this entry now carries the agency-side treatment of injection.

The practitioner lesson

Strip away the entry-by-entry movement and one principle remains: incident counts understate the risks you already fight hardest. A public CVE feed is a record of failures that were discovered, disclosed, and easy to attribute — it is systematically quiet exactly where defense is strong or attribution is hard.

• Do not deprioritize a control because its public incident count is low. A quiet count can mean the defense is working, not that the risk is gone. Prompt injection is the worked example.
• Read the vote and the data together. Belief catches unrealized exposure; the record catches widespread harm the field underweights. Neither is sufficient alone.
• Watch the boundary. This list owns the risk while the model is a component. The moment it becomes an actor — calling tools, carrying memory across sessions, driving downstream consequences — the risk moves to the OWASP Agentic (ASI) Top 10. Pair the two; the most consequential 2026 mover, Excessive Agency, sits right on that seam.

For the item-by-item view of what changed between 2025 and 2026, see the companion overview: What changed in the OWASP LLM Top 10 2026. For the agent-as-actor side, the OWASP Agentic (ASI) Top 10 is available (currently in Turkish).

Honesty note and sources

The English entry IDs and titles quoted here (LLM01–LLM10) are the official OWASP titles. The summaries, tables, and any machine-readable JSON we maintain are a community-maintained derivative under CC BY-SA 4.0; the authoritative text lives in the official OWASP document. Where our phrasing and the OWASP document differ, the OWASP document governs.

• Official: OWASP GenAI Security Project — LLM Top 10 for 2026 (CC BY-SA 4.0), including the "Letter from the Project Leads" that documents the methodology and weighting.
• Turkish translation and notes: github.com/fevziegeyurtsevenler/owasp-llm-top10-2026-tr.
• Machine-readable dataset: Hugging Face — owasp-llm-top10-2026-tr.

Frequently Asked Questions

How were the OWASP LLM Top 10 2026 rankings decided?

For the first time, the community vote was tested against a record of real incidents. OWASP gathered 7,714 incidents from public vulnerability databases and an AI-harm database, and classifiers sorted the 6,639 that carried enough detail. The final ranking weights the vote at 75% and the incident data at 25%.

Why is Prompt Injection still #1 if it falls out of the top 10 by incident count?

Because of the defense effect. Teams defend prompt injection so heavily that clean, reportable exploits reach public databases less often, so the public count understates the real risk. The untrusted-input surface can never be fully closed, and there is no reliable prevention today, so the community vote kept it at LLM01 despite the low raw count.

What is the 'defense effect'?

It is the pattern where a heavily defended risk shows a low public incident count not because the risk is small, but because mitigation suppresses the clean exploits that would otherwise be catalogued. A quiet CVE feed can be a sign that defense is working, not that the risk has gone away.

Why did Misinformation move up to #7?

It showed the widest belief-versus-evidence gap in the harmful direction: voters ranked it relatively low, but the incident record ran high. The 25% incident weight was enough to move it up a tier, from 9 to 7.

Can a 25% weight really change the list?

It can move an entry a tier where belief and evidence diverge widely — up, as with Misinformation, or preserved against a misleading count, as with Prompt Injection. It is not enough to rewrite the ranking, which keeps a noisy incident dataset from overturning the field's collective judgment.

Are the titles used here the official OWASP titles?

Yes. The entry IDs and titles (LLM01 to LLM10) are the official OWASP titles. The summaries and any JSON we publish are a community-maintained derivative under CC BY-SA 4.0; the authoritative text is the official OWASP document, which governs where wording differs.

Sources