The 2026 OWASP ranking
In August 2026, the OWASP GenAI Security Project published a new edition of its Top 10 for LLM Applications. For the first time, the ranking takes real incident data into account in addition to the community vote. The big trends: prompt injection stays at the top, and excessive agency climbs to third place, a sign that agents are spreading faster than their controls.
1 to 3: injection, disclosure and agency
- 1. Prompt injection. Text that makes the model ignore its instructions. Direct: the user types it. Indirect: it is hidden in an email, a document, a web page or even an image the AI reads. The 2026 edition also covers instructions hidden in audio and images, and instructions that persist in an assistant’s memory.
- 2. Sensitive information disclosure. The model reveals personal information, business data or secrets present in its context, its documents or its training data.
- 3. Excessive agency. The AI has more functions, permissions or autonomy than it needs. A successful injection then becomes a real action: emails sent, data changed, purchases made.
What helps: treat all external content as untrusted, give the agent the bare minimum of rights, and require human confirmation for high-impact actions.
4 to 6: supply chain, poisoning, consumption
- 4. Supply chain. Compromised models, datasets, plug-ins or libraries. The 2026 edition explicitly mentions tampered model weights and unsafe serialization formats that can run code when loaded.
- 5. Data and model poisoning. An attacker manipulates training data, fine-tuning data or the document base to introduce bias, backdoors or favourable answers.
- 6. Unbounded consumption. Bursts of requests or very long ones that blow up the bill, slow the service down or allow the model’s behaviour to be extracted.
What helps: only use models and components from verified sources, control who can feed the document base, and set quotas and cost alerts.
7 to 10: misinformation, hidden context, vectors and outputs
- 7. Misinformation. The model confidently invents facts, references or policies. The organization remains responsible for what its AI says.
- 8. Hidden context exposure. Formerly “system prompt leakage”. The model reveals its instructions, its configuration or internal policies. Simple rule: no secret (password, API key) should ever be in a prompt.
- 9. Vector and embedding weaknesses. In retrieval-augmented generation (RAG), documents can be retrieved for a user who has no right to see them, or a vector database can be poisoned.
- 10. Improper output handling. The model’s response is rendered or executed without validation: injected HTML, SQL query, system command, or a remote image that carries data in its URL.
Two real cases
EchoLeak (June 2025). Researchers at Aim Security showed that a single email containing hidden instructions could get Microsoft 365 Copilot to pull internal data and send it outside, without the victim clicking anything. Microsoft fixed the flaw (CVE-2025-32711, CVSS score 9.3) before disclosure, with no known exploitation. The case combines three risks from the ranking: indirect injection, information disclosure and improper output handling.
Moffatt v. Air Canada (2024). Air Canada’s chatbot told a customer he could apply for a bereavement fare after his trip, contradicting the company’s policy. British Columbia’s Civil Resolution Tribunal rejected the argument that the chatbot was a separate entity and held Air Canada liable for negligent misrepresentation. A clear lesson about misinformation: what your AI says binds you.
What about agents?
In December 2025, OWASP published a separate ranking for agentic applications. It includes agent goal hijacking, tool misuse, identity and privilege abuse, memory poisoning, insecure inter-agent communication and cascading failures. If your teams are deploying agents, that is the next thing to read.
The next article covers governance: the frameworks and obligations that apply in Québec and Canada.