The OWASP Top 10 for LLM Applications is a category checklist, not a priority queue. The 2026 edition blends a practitioner vote — about 29 respondents, by the project leads' own count — three-to-one with a corpus of labeled incidents, and on 18 August those leads published the measurement showing the two signals agree at Cohen's weighted kappa of 0.20, with a 90% interval running from −0.16 to 0.57. The interval crosses zero.
If you have been sequencing controls, staffing or RFP requirements off the rank numbers, that is the paper you needed to read. Map your controls to all ten categories. Get the order from your own exposure data.
What Steve Wilson and Rock Lambros Measured
The two project leads ran their own ranking against the public incident record and reported that the two barely agree. Their paper, Incident-Data Robustness Analysis of the OWASP Top 10 for LLM Applications (2026), was posted on 18 August 2026.
The method is straightforward. They snapshotted 7,714 incidents and labeled 6,639 of them against a 20-category candidate taxonomy: 6,297 from the CVE, GHSA and OSV vulnerability databases and 342 from the AIAAIC AI-harm database. Three open-weight models — Qwen 235B, Llama 405B and DeepSeek V3 — classified each incident independently, and their consensus produced an incident-based ranking, corrected for classifier precision and recall, to set beside the expert one.
Cohen's kappa measures how much two raters agree beyond what chance alone would produce, where 1.0 is perfect agreement and 0 is chance. At 0.20 with an interval spanning zero, the paper's own conclusion is that "we cannot exclude chance-level agreement."
Two numbers give that its weight. The expert ranking comes from "about 29 respondents" who scored each candidate risk on importance, aggregated to a median rank per entry. That figure appears in no other account of the release — coverage of the 2026 list instead describes the vote as the judgment of "hundreds of practitioners who attack and defend these systems daily". The two are reconcilable — a working group can have hundreds of contributors and twenty-nine returned ballots — but nobody has published which, and the leads measured the ranking as it stood before publication rather than the shipped list. And the published list gives three-quarters of the weight to the vote and one quarter to the data — a deliberately asymmetric blend, confirmed in the release coverage, designed to let incident data move a risk a tier without overturning consensus on one imperfect corpus.
Steel-man it properly, because the authors do: they argue that weak agreement and a stable ranking are not in tension, and that "a quarter-weight corrective that agrees weakly is doing exactly what it was designed to do." They also flag the work as exploratory analysis by working-group members that predates the official 2026 list, and explicitly not an official OWASP release. That is more candour than most standards bodies offer about their own instrument.
Prompt Injection: #1 by Vote, #12 by Incidents
The widest gap between the two signals sits at the very top of the list. LLM01 Prompt Injection is expert-rank #1 with an interval of 1–2, and incident-rank #12 with an interval of 4–18. It ships at #1 anyway, unchanged from 2025, in the 2026 release published on 4 August.
The paper's explanation is the right one: "Prompt injection is the best-understood LLM attack, and deployed systems defend against it actively. Successful, publicly reported exploits are correspondingly rarer, so the incident record sees fewer of them."
That is the whole problem with reading incident counts as risk. A CVE-derived corpus measures disclosure, not occurrence. It does not see the injection your gateway blocked, the one your vendor patched quietly, or the one your incident response team closed under NDA. The exploits that do surface are not minor: EchoLeak (CVE-2025-32711, CVSS 9.3) achieved zero-click exfiltration out of Microsoft 365 Copilot; an injection buried in repository code walked GitHub Copilot into arbitrary code execution on the developer's own machine (CVE-2025-53773, CVSS 7.8); and the DuneSlide pair in Cursor (CVE-2026-50548 and CVE-2026-50549, CVSS 9.8) turned a zero-click injection into arbitrary commands outside the IDE sandbox. A handful of disclosures — twelfth place in a frequency count, first place in blast radius.
OWASP's own 2026 agentic-security review reaches the same conclusion from the other direction, mapping prompt injection to six of the ten categories in its Top 10 for Agentic Applications — the universal joint that connects most agent incidents rather than a discrete bucket you can count. If your agents chain tools, this is the same failure mode behind cross-agent privilege escalation and assistant memory that survives a credential reset.
Where the Incident Data Actually Moved the List
Misinformation is the entry where the corpus pulls hardest against the vote, and it is also the entry the corpus measures worst. It sits at expert-rank #13 against incident-rank #2, and the paper puts the probability that the two signals disagree at 99 percent — the entry the incident record most disputes. On the published list it lands at LLM07, up from LLM09 in 2025, per the 2025-to-2026 mapping.
Now read the limitation the same paper prints. That #2 incident rank is driven by "a large volume of deepfake and AI-generated disinformation from the AIAAIC harm database" — the 342-entry stratum, 5% of the labeled corpus. And all 323 of the paper's hand-verified precision checks came from the security stratum: the ai-harm stratum has no precision measurements at all, so the model falls back to a flat prior with a mean of 0.5.
The same distortion shows in a candidate that did not make the cut. Weaponized LLM Abuse ranked #17 by expert vote and #8 by incidents, and the authors note that "Most of these describe harm produced by an AI rather than a vulnerability inside an LLM."
For a security team that distinction is not academic, it is an org chart. An ungrounded answer inside your product is an application security defect with an owner, a test case and a fix. A synthetic-voice deepfake of your CFO authorising a wire is a fraud problem with a different owner, a different budget line and different controls. The 2026 list files both under one heading and moves that heading up two places — and the incident signal arguing for the move is drawn from the stratum the analysis measures least well.
Nobody Beat the Cheap Classifier
Four frontier models were pre-registered to beat the three-model labeling ensemble, and none of them did. The ensemble floor scored 0.863 balanced accuracy; Llama 405B managed 0.744, Qwen 235B 0.733, DeepSeek V3 0.711 and Mistral Large 0.691. "Every frontier model's apparent edge over the floor dissolves under a bootstrap."
The gold set is where this gets instructive for anyone planning to build their own incident taxonomy. One reviewer adjudicated all 1,200 gold incidents. That reviewer's blind label disagreed with model consensus at a rate of 0.75, and final adjudication overrode the consensus on 553 of 1,200 cases. As the paper says, "a single annotator cannot measure inter-rater reliability."
Per-category precision ran from 93% on the two best-defined entries down to 13% on the worst. And the base classifier "never predicts 'out of scope': it assigns a specific taxonomy category to every incident, including the roughly 38% of the gold set that is truly out of scope."
If you were planning to point three models at your own ticket history and get a risk ranking out, those are your numbers too. The classification is the cheap part. Adjudication is the cost, and it is the part that decides whether the output means anything — the same lesson as grading agent pilots pass/fail instead of on an average score.
Compare It to the Web Top 10 It Is Named After
The list this one borrows its name from is built on measurement the LLM list does not have yet. The OWASP Top 10:2021 drew on donated data covering "over 500,000 applications," selected "eight of the ten categories from contributed data and two categories from the Top 10 community survey," and ranked on a defined statistic: "the incidence rate asks what percentage of the application population had at least one instance of a vulnerability type."
Incidence rate is the number that makes an ordinal meaningful. It is a measured share of a known population, not a count of what got reported.
The LLM list cannot compute one, because nobody has enumerated the population of LLM applications, let alone tested a representative sample of it. That is not a failure of the people who built it — it is the honest state of a three-year-old discipline. But it does mean the number beside each entry is a forecast, and forecasts in this list have a short half-life. The archived 2023 v1.1 list carried Model Denial of Service at #4 and Model Theft at #10. Neither survives in 2026.
What to Do Before Your Next Control Review
Treat the ten categories as coverage and your own telemetry as priority. Concretely:
This Week:
- Diff your control catalogue against the 2026 ordering, not the 2025 one. Excessive Agency moved from LLM06 to LLM03, Unbounded Consumption from LLM10 to LLM06, and Improper Output Handling fell from LLM05 all the way to LLM10, per the published mapping. System Prompt Leakage was renamed and widened to Hidden Context Exposure, which Check Point reads as covering retrieved documents, memory, user information, application state and tool responses — a materially larger surface than the old name implied.
- Compute your own incidence rate, category by category. For each of the ten, count how many of your deployed AI applications have at least one confirmed instance. You already have the inputs: gateway logs, red-team findings, the agent inventory, last quarter's incident tickets. Ten numbers on one page beats a borrowed ordinal.
- Split Misinformation into its two owners before it hits a budget meeting. Ungrounded output in your product goes to application security. Synthetic media impersonating your executives goes to fraud and brand protection. One heading, two programmes.
This Month:
- Re-read any RFP or contract clause that names "the OWASP LLM Top 10 top three." The top three changed this month. A vendor certified against 2025's top three has not been assessed against Excessive Agency at #3, and Excessive Agency is where agent deployments actually fail.
- Write down where your data and the list disagree, and make that your test plan. The paper's own advice is the best line in it: "Where they agree, confidence rises; where they diverge, the divergence itself is the finding." A category you rank low and OWASP ranks high is either a gap you have not seen yet or a control that is working — and red-teaming before production is how you tell those apart.
Before Renewal:
- Ask each AI security vendor which categories it covers and on what evidence. Guardrail products like Lakera and model-security platforms like HiddenLayer map cleanly to specific entries; governance platforms like Credo AI map to the audit line rather than the runtime control. A vendor claiming coverage of all ten is claiming something the framework's own authors would not.
- Do not inherit an assurance argument you did not run. The same reasoning that applies to inheriting a model vendor's safety evaluations and to a single firm running three labs' cyber evals applies here: a ranking is a measurement, and a measurement someone else took on a different population is context, not evidence.
The Bottom Line
Every security top-ten is a compression — a large, messy risk surface squeezed into something a budget committee can read in one slide. The compression is useful. The web Top 10 earned its ordinal over two decades and half a million tested applications, and it still reserves two slots for what the data cannot see yet. The LLM list is three years old, ranks on 29 votes and a borrowed corpus of other people's disclosures, and its authors have now published exactly how loosely those two agree. That is a healthier position than most frameworks are in, precisely because they said so.
So use it the way its authors do. The categories are complete enough to audit against, and the 2026 release maps them into MITRE ATLAS, NIST AI RMF and the CSA AI Controls Matrix so your GRC team can wire them into an existing control set — the same pattern as buying inventory rather than policy packs for AI Act compliance. What the list cannot tell you is which of the ten is costing you money right now. Nothing published in August can.
Ten categories is a map worth having. The numbers beside them are a forecast — and it is not a forecast about you.
Continue Reading
- Anthropic's Evals Maxed Out. Stop Inheriting Its Assurance.
- One Firm Ran Three Labs' Cyber Evals. Name Yours.
- One Agent Escalated Another. Every Call Was Authorized.
- How to Red-Team Your AI Agents Before Production
- EU AI Act Governance Tools: Buy Inventory, Not Policy Packs
- Copilot Memory Survives Your Password Reset. Go Purge It.
- Agents Averaged 73. Only 30% Were Usable. Grade Pass/Fail.
- Agentjacking: AI Agents Hijacked via Fake Bug Reports