Excessive Agency Jumped to #3 on OWASP's LLM Risk List. Here's What 7,714 Real Incidents Say About Where the Risk Actually Lives
OWASP published the third version of its LLM Top 10 on August 4, 2026, and for the first time the rankings were checked against a corpus of real-world incidents, 7,714 total, 6,639 with enough detail to classify, rather than built purely from a community practitioner survey. That methodology change surfaced a gap worth paying attention to: what security teams say they're worried about and what's actually causing damage in production don't fully overlap.
What moved, and why it matters
Prompt injection held the #1 spot for a third consecutive year, despite a relatively low count of incidents directly tied to it in the actual data, largely because it remains the most discussed and most feared risk in the practitioner community. Excessive agency, agents being handed more functionality, permissions, or autonomy than a task actually requires, jumped from #6 to #3, reflecting real incidents where a manipulated output led to real damage specifically because the agent had the permissions to act on it. Misinformation showed the widest gap of all: ranked lowest in the community vote, but scoring near the top when measured against actual incident data. OWASP's own framing calls this a gap "in the dangerous direction," meaning the risk practitioners rank as least urgent is quietly one of the most damaging in practice.
The reframe for anyone evaluating an AI SaaS tool
Most vendor security questionnaires still center on prompt injection defenses, because that's the risk everyone already knows to ask about. The incident data says that's not where the disproportionate damage is coming from. Excessive agency means the actual audit question is different: not "can this agent be tricked into saying something wrong," but "what is this agent structurally permitted to do, and does that scope match what the task actually requires." A perfectly injection-resistant agent with delete access it doesn't need is still a real risk. A less hardened agent with tightly scoped permissions may be the safer system in practice.
OWASP's stated mitigation posture for 2026 reflects this directly: design on the assumption that instruction boundaries will eventually be bypassed, and constrain what the system is structurally capable of doing, rather than betting everything on filtering what it's told. That's a permissions-first posture, not a detection-first one.
What to actually ask a vendor
- What is the full list of actions this agent can take, not just the actions it's designed to take.
- Is there a difference between what the agent is intended to do and what it's technically permitted to do? That gap is where excessive agency lives.
- How are permissions scoped per task, and are they reviewed on a schedule, or only granted once at setup and left alone.
- What's the actual incident history, not just the vendor's stated defenses against prompt injection specifically.
A risk ranking built from real incidents instead of a survey is a meaningfully better signal than the two prior versions of this list. Worth updating your own vendor evaluation checklist to match what it actually found, not what conventional wisdom assumed going in.