Prompt injection OWASP ranking diverges from public incident data

Two leaders of OWASP’s Top 10 for LLM Applications project found a sharp split in the prompt injection OWASP ranking: the threat is No. 1 on OWASP’s expert-led list but No. 12 in their analysis of reported incidents. The result is less a verdict on the threat’s severity than a warning that CVE counts and vulnerability scans do not capture every way an AI agent can be manipulated.

Kyriakos “Rock” Lambros and Steve Wilson published the analysis on August 18. It is exploratory, has not been peer reviewed, is not an official OWASP publication and does not replace the organization’s ranking process, the authors said.

The researchers assembled 7,714 LLM-security incidents from CVE records, GitHub Security Advisories, OSV and the AIAAIC AI-harm database. They labeled 6,639 of those records across a 20-category taxonomy, then used a Bayesian model intended to account for classification error before comparing the resulting incident order with the expert list.

The two rankings showed weak statistical agreement. The paper reported Cohen’s kappa of 0.20, with a 90% interval from -0.16 to 0.57. Because that range crosses zero, the authors said the comparison cannot rule out agreement occurring by chance.

Why does prompt injection look less common in incident data?

Prompt injection occurs when hostile instructions are placed in material an LLM is asked to process, such as a support ticket, log entry or retrieved document. If an agent treats that material as instruction and invokes a tool with credentials it already has, the failure may not depend on a conventional software flaw. That means it may not create a CVE or appear in ordinary vulnerability-scanning results.

Public incident data is therefore a record of attacks that were observed, recognized, classified and reported, rather than a complete measure of exposure in systems now being deployed. Lambros and Wilson’s paper argues that experts may rank prompt injection highly because the potential attack surface remains broad even where defenses stop many attempts.

CrowdStrike’s 2026 Global Threat Report offers evidence of attempted abuse, though not an explanation for the No. 12 placement. The company reported malicious prompts used against legitimate generative-AI tools at more than 90 organizations in 2025, including cases involving credential and cryptocurrency theft.

What should AI-agent teams change?

Wilson, Exabeam’s chief AI and product officer and an OWASP project co-lead, said consequential permissions should be enforced outside the model. In his example, an agent could recommend a DNS change but could not authorize and execute that change on its own. Instructions within a prompt can influence an LLM’s response, he said, but do not constitute an enforceable permission boundary.

For operators, that points to testing deployed agent workflows against adversarial inputs and limiting the tools, systems and resources an agent can reach. External authorization gates reduce an agent’s freedom to make arbitrary high-impact changes, Wilson said, while allowing investigation and routine remediation within defined limits.

The study found other mismatches as well. Misinformation ranked No. 13 in the expert assessment and No. 2 in the incident data. The authors cautioned that many records in that category concern AI-generated harm, including deepfakes and disinformation, rather than vulnerabilities inside an LLM. That limitation reinforces the central point: incident totals and risk prioritization answer related, but different, questions.

This story draws on original reporting from VentureBeat.