The OWASP Top 10 for LLM Applications 2026: agentic security is the new frontier

The list changed because the systems changed

OWASP released its 2026 Top 10 for large language model applications, and the shift is telling. The 2025 list was dominated by prompt injection, sensitive information disclosure, and insecure output handling. The 2026 list keeps those, but it adds a new category that reflects where the industry is heading: agentic security. When an LLM does not just generate text but takes actions, calls tools, and makes decisions, the risk is no longer what it says. It is what it does.

The Akamai analysis of the 2026 list makes the point clearly. The top risks now include improper tool usage, excessive agency, and unbounded actions. A model that can read your email, send messages, and approve payments is not a chatbot. It is an employee with a keyboard, and it has no judgment about when to stop.

The failure mode is not the model, it is the deployment

The classic story is Knight Capital in 2012. A deployment error let an automated trader fire millions of orders in 45 minutes, losing about 440 million dollars. The model was not malicious. The rollout was not tested, there was no kill switch, and the blast radius was unlimited. The EU AI Act's Article 15 requires accuracy, robustness, and cybersecurity, but the real lesson is operational: you need a way to stop the system when it goes wrong.

Zillow in 2021 is the same pattern. Their automated home-buying model mispriced properties at scale as the market shifted. They took a 500 million dollar write-down and shut the program down. The model was not drifting in a way anyone noticed until the losses were enormous. There was no post-market drift monitoring, and no human gatekeeping on price thresholds.

Both failures are model risk, but not in the way most people think. The model did not suddenly become evil. The deployment was sloppy, the monitoring was absent, and the humans were out of the loop. The 2026 OWASP list is a warning that agentic systems make this worse. A drift in a text generator produces a weird answer. A drift in an agent produces a financial transaction.

What the 2026 list actually requires

The new agentic security category is not a suggestion. It is a demand that you treat the model's actions as a first-class risk surface. That means you need to know what tools the model can call, what data those tools can access, and what the consequence of a bad call is. The OWASP list calls out excessive agency, where a model has more permissions than it needs. The fix is the principle of least privilege, applied to AI. The model should only be able to do what it must do, and nothing else.

You also need to watch for the attacks hidden inside retrieved documents and tool results, not just in what the user typed. An agent that reads a PDF and then acts on its contents can be manipulated by a malicious PDF. This is not a theoretical concern. It is the new prompt injection, and it is harder to spot because the user never typed anything suspicious. Argus (argus.threatclaw.ai) records every trace an AI application produces and scans for exactly these attacks, including the ones buried in documents and tool outputs. Governance decides what an agent is allowed to do. Argus shows what it actually did.

The controls that matter

The EU AI Act's Article 72 requires post-market monitoring for high-risk systems. That is a legal obligation to watch for drift and incidents after deployment. NIST's AI Risk Management Framework, under its MEASURE function, asks you to track model performance over time. Both point to the same operational need: you cannot manage what you do not measure.

For agentic systems, the specific controls are a kill switch, blast-radius limits, and staged rollout. A kill switch is a hard stop that any operator can trigger. Blast-radius limits constrain what a single bad action can do, for example, a per-transaction cap on an automated payment system. Staged rollout means you deploy to a small, controlled environment first, watch for anomalies, and only then expand. Knight Capital had none of these. Zillow had no drift monitoring and no human gate on price thresholds.

Key risk indicators

Track the population stability index (PSI) and Kolmogorov-Smirnov (KS) statistics on your top features each week. If the input distribution shifts, the model's behavior will shift with it. Measure the time from a drift alert to a mitigation. If it is more than a day, your monitoring is decorative. And track the share of model-driven actions that sit behind circuit breakers. If it is not close to 100 percent, you have unbounded actions that no one can stop.

What to do

• Inventory your agent's tools. List every tool the model can call, what data it can access, and what the worst-case outcome of a bad call is.
• Apply least privilege. Remove any permission the agent does not strictly need. A model that reads email does not need to send it.
• Build a kill switch. Make sure any operator can stop the agent instantly, and test it weekly.
• Set blast-radius limits. Cap the value of any single action, and require human approval above that cap.
• Monitor drift weekly. Track PSI/KS on your top features, and set a threshold that triggers a human review. For a deeper look at the threat side, the ThreatClaw article "Why Your AI Assistant's Tools Are a Hacker's Best Friend" (https://www.threatclaw.ai/blog/why-your-ai-assistants-tools-are-a-hackers-best-friend) explains how attackers abuse tool permissions, and ThreatClaw (www.threatclaw.ai) tracks these threats across 22 live intelligence feeds. A control is only as good as the threat it is sized against.

The bottom line

The 2026 OWASP list is a wake-up call. Agentic AI is not a chatbot with a nicer interface. It is a system that can act, and action has consequences. The companies that treat agent permissions like production credentials, with the same rigor, will survive. The ones that let their agents roam free will write the next Knight Capital case study.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.

Related reading:

• Why Your AI Assistant's Tools Are a Hacker's Best Friend on ThreatClaw
• Why Your AI Audit Misses the Server Room Entirely on ThreatClaw