By admin 
A Chief Information Security Officer (CISO) who dismisses prompt injection as a minor threat due to a low Common Vulnerabilities and Exposures (CVE) count is fundamentally misinterpreting the landscape of artificial intelligence (AI) security. Prompt injection has held the unenviable No. 1 spot on the OWASP Top 10 for LLM Applications for three consecutive years, a testament to its persistent and evolving danger. However, a recent groundbreaking analysis by two leading figures in the OWASP LLM Top 10 project, Kyriakos “Rock” Lambros and Steve Wilson, reveals a stark disconnect between expert opinion and the publicly recorded incident data. When they cross-referenced the esteemed expert rankings with a dataset of 6,639 labeled real-world incidents, prompt injection plummeted to No. 12. This dramatic drop, however, is not an indicator of diminishing danger, but rather a reflection of the attack’s insidious nature, operating in a blind spot inaccessible to conventional vulnerability scanners.
The eye-opening findings, published on arXiv on August 18th, are the result of an exploratory analysis, explicitly disclaimed by the authors as not peer-reviewed and not an official OWASP release. Despite these caveats, the research offers a compelling, data-driven perspective that challenges established risk assessments. The study meticulously processed 7,714 LLM security incidents sourced from CVE, GitHub Security Advisories, OSV, and the AIAAIC AI-harm database. Of these, 6,639 were meticulously labeled against a 20-entry taxonomy. A sophisticated Bayesian model was then employed to correct each count for classifier error, thereby establishing a data-driven ranking that was then juxtaposed against expert consensus.
The comparison yielded a startling lack of statistically detectable agreement between expert judgment and the public incident record. The measure of agreement, Cohen’s kappa, registered a mere 0.20, with a 90% interval ranging from a negative 0.16 to a positive 0.57. The authors candidly state, "The interval crosses zero, so we cannot rule out that the two rankings agree only by chance." Their "honest bottom line" is a stark declaration: "weak agreement, not confirmation."
Lambros, who also serves as the co-lead of the OWASP GenAI Security Project Top 10 for LLM Applications and director of AI standards and governance at Zenity, elaborated on these findings in written responses to VentureBeat. He articulated the situation in evidentiary terms: "We had two ways of measuring the same risk, expert judgment and the public incident record, and they disagree with each other. Neither one is the truth." He further emphasized the analogy, "Two witnesses are contradicting each other, and we can’t tell you which one is lying." This highlights the critical dilemma faced by security professionals: how to prioritize defenses when the established indicators of risk are in direct conflict.
The Attack Chain a Scanner Never Logs
The fundamental reason for this disconnect lies in the very nature of prompt injection. This attack vector bypasses traditional security controls by embedding malicious instructions within the content that a Large Language Model (LLM) processes. This can range from seemingly innocuous log entries and support tickets to retrieved documents. The LLM, interpreting these embedded instructions as legitimate commands, then executes a tool call dictated by the attacker, often leveraging credentials it legitimately possesses. Crucially, the attack chain itself does not involve a product defect, meaning it leaves no exploitable vulnerability (CVE) for automated scanners to detect.
Effective defenses against prompt injection are not found in signature-based detection but rather in adversarial testing of deployed systems and stringent limitations on the scope of an agent’s actions. These "hard caps" ensure that even a compromised model cannot access sensitive or critical resources. This architectural approach underscores the necessity of investing in robust agent memory management and strict Multi-Cloud Platform (MCP) tool boundaries from the outset, rather than waiting for the inevitable surge of advisories that will invariably lag behind emerging threats.
The First Control Wilson Would Deploy
Steve Wilson, Chief AI and Product Officer at Exabeam and a co-lead for the OWASP Top 10 for LLM Applications, identified the precise attack chain he would prioritize defending against: an agent that ingests an attacker’s payload within a log file, misinterprets it as an instruction, and subsequently rewrites DNS records using valid credentials. In his response to VentureBeat, Wilson articulated his immediate defensive strategy: "The first thing I’d do is put an authorization gate outside the model: the agent can propose the exact DNS change, but it cannot grant itself the authority to make it." He further clarified, "Security rules written inside prompts may shape the model’s behavior, but they are still suggestions to the model, not enforceable security controls."
Wilson acknowledged the inherent trade-off associated with such a control: "The tradeoff is that the agent loses the ability to improvise arbitrary, high-impact infrastructure changes on its own, while retaining autonomous investigation and routine, bounded remediation." This pragmatic approach emphasizes that robust security often involves limiting the potential for autonomous action, even if it curtails some operational flexibility.
Why the No. 1 Risk Looks Small in the Record
The authors of the arXiv paper offer a concise explanation for prompt injection’s anomalous position in the incident data: "Prompt injection is the best-understood LLM attack, and deployed systems defend against it actively." They then distill the core of the divergence into a single, potent sentence: "Experts rank it first because the attack surface stays enormous even when the defenses mostly hold; the data sees the successes that got through."
Wilson, having observed this phenomenon from multiple vantage points, offered his perspective on the limitations of incident data: "Incident data is incredibly valuable, but it is inherently backward-looking and notoriously tricky to interpret. It tells us what was observed, recognized, classified, and reported. It does not necessarily tell us what is most dangerous in the systems people are building right now." He draws a parallel between prompt injection and "death and taxes," and increasingly, "a law of physics for LLM systems," due to the fundamental challenge of a single model being tasked with interpreting both trusted instructions and untrusted content simultaneously.
The pursuit of better defenses has not eradicated the problem. "A control that works 99% of the time is not sufficient when the failure case gives an attacker meaningful access. And, frankly, I don’t think we are at 99%," Wilson stated. He advocates for a paradigm shift in defensive strategy: "The durable answer is not believing we can perfectly screen prompt injection out of existence. It is designing systems with the assumption that prompt injection will occur, understanding why it works, and limiting what an attacker can accomplish when it does." A low advisory count, therefore, could indicate either effective defenses or a critical lack of visibility, a distinction the public record struggles to make.
Evidence of the sheer volume of attempted attacks is documented. CrowdStrike’s 2026 Global Threat Report, under the striking title "Prompts are the New Malware," revealed that adversaries targeted legitimate Generative AI (GenAI) tools at over 90 organizations in 2025, successfully stealing credentials and cryptocurrency. While this telemetry clearly demonstrates mounting pressure on the attack surface, it does not definitively prove that defenses are the reason for prompt injection’s No. 12 placement in the incident record; rather, it aligns with the predicted pattern of this pervasive threat.
The Gap Runs the Other Way, Too, and Further
Prompt injection, while a headline-grabbing threat, is not the only area where expert opinion and incident data diverge. Misinformation presents an even more significant discrepancy. While expert consensus ranks it at No. 13, the incident record places it at a striking No. 2. The paper highlights this as "the widest disagreement between the two witnesses," reporting a 99% probability that the two signals are in conflict.
However, the authors are careful not to definitively declare the experts wrong. They acknowledge that the incident corpus "carries a large volume of deepfake and AI-generated disinformation," but often records "describe harm produced by an AI rather than a vulnerability inside an LLM." This nuance suggests that the incident data might be capturing a broader spectrum of AI-related harms, not exclusively LLM vulnerabilities.
Where "Too New to Measure" Runs into the CVE Record
Two newly identified taxonomy entries, Persistent Memory Poisoning (expert No. 4, incident No. 16) and MCP Tool Interface Exploitation (expert No. 7, incident No. 16), illustrate the challenges of quantifying emerging threats. Each has an incident interval of 6 to 20, spanning a significant portion of the taxonomy. Despite their nascent status, public CVEs do exist for both.
For MCP tool interfaces, the Azure Data Explorer MCP Server exhibited KQL injection, a vulnerability (CVE-2026-33980, scored 8.3 High) that allows an attacker or an AI agent to execute arbitrary KQL queries. Similarly, Kong’s Konnect MCP Server shipped an indirect prompt injection (CVE-2026-13341) enabling remote attackers to steer the server into executing unintended API requests, a precise failure mode anticipated by the MCP entry.
Agent memory also has its nascent record. An agent harness named Ruflo exposed unauthenticated MCP bridge endpoints, granting network attackers shell access, the ability to steal provider API keys, and poison the learning store (rated 10.0 Critical). The public record for these emerging threats is so thin and uncertain that the Bayesian model struggles to place either entry within a meaningful rank range. Organizations waiting for a deluge of advisories to justify implementing controls on agent memory or MCP tool boundaries would find themselves waiting indefinitely while critical and high-severity CVEs accumulate.
Lambros frames the budgetary argument in practical operational terms: "Poisoned memory doesn’t announce itself." He likens it to an agent being instructed to approve invoices from a specific supplier under $50,000 without a second signature. Because the agent remembers this instruction, subsequent approvals appear to follow the correct process, masking the underlying compromise. "Nobody files an advisory for that, because nobody knows it happened. A count of zero is measuring your blindness, not your safety." He posits that the most compelling argument for a CFO would be the timing of these foundational security measures. "Memory and tool permissions get wired into these systems once, early, and everything else sits on top of them. Build it in now and it’s a rounding error. Come back in two years and you’re re-architecting and re-training your systems."
The Authors Flag Their Own Measurement Problems First
The researchers are upfront about the limitations of their own methodology. The "expert signal" is derived from a practitioner survey with approximately 29 respondents scoring each candidate risk. This modest number forms the basis of the ranking that carries significant weight in the OWASP list, representing a crucial compression point for the project’s more than 25,000 community members.
On the data side, the classifier itself is identified as a weak link. Its precision "varies sharply across entries, from 93% (LLM01, LLM03) down to 13% (LLM08)." Four entries fall below the 50% precision threshold, and critically, the base classifier "never predicts ‘out of scope’ and files every incident into some category, including the roughly 38% of the gold set that belongs in none."
The authors pinpoint the central limitation: a single annotator adjudicated all 1,200 gold-set incidents, overriding the model consensus on 553 of them. "A single annotator cannot measure inter-rater reliability," they state, concluding, "The single-author gold set remains the central limitation." Lambros attributes the weak kappa score to the inherent ambiguity of the taxonomy itself. "That number is telling you about our categories, not about our experts," he argued. When the creators of a taxonomy struggle to reliably sort incidents into its predefined buckets, a weak agreement score on the ordering of those buckets is, in essence, a fact about the buckets themselves.
Even advancements in classifier technology have not resolved the core issue. A pre-registered bake-off of four frontier models yielded no definitive winner. None surpassed the incidence floor’s balanced accuracy of 0.863, and a ground-truth check maintained the floor’s ordering with a Spearman correlation of 0.918. The researchers have generously published the engine and artifacts on GitHub for public scrutiny and replication. However, the robustness results primarily validate the stability of the incident-derived ranking when labeling machinery is altered, but they do not address the inherent uncertainty stemming from the 29-vote expert survey. This distinction is crucial: "robust" in this context signifies stability, not validated accuracy.
What the Published List Did with This
OWASP released the GenAI LLM Top 10 2026 on August 4th, marking the first edition to incorporate incident data into its ranking. The weighting now stands at 75% for practitioner votes and 25% for the incident corpus. Prompt injection, predictably, retained its No. 1 position. Misinformation ascended two spots, while Excessive Agency climbed from No. 6 to No. 3, representing the entry where the two signals exhibit the clearest agreement. Unbounded Consumption rose four spots to No. 6, and Improper Output Handling experienced the most significant drop, falling from No. 5 to No. 10.
Wilson remains pragmatic about the weighting, stating, "There is nothing magical about a 75/25 weighting, or about reversing it to 25/75. The value of the data wasn’t that it gave us a mathematical answer; it changed the conversation." For him, the entry where this evolved conversation had the most profound impact was Excessive Agency. "If I were a CISO evaluating a new agentic deployment today, Excessive Agency is where I would start," Wilson declared.
Lambros advocates for a more nuanced approach in future iterations. He suggests that the current 25% incident weight is applied uniformly across all categories, irrespective of the classifier’s precision. He notes that the precision for prompt injection and supply chain threats hovers around nine in ten, while for vector and embedding weaknesses, it drops to roughly one in eight. "The ratio should track how well we actually measure each category," Lambros argued, implying a need for differential weighting based on measurement confidence.
Why This Lands Now
The timing of this research is particularly relevant given current trends in AI adoption. Ivanti’s 2026 State of Cybersecurity research found that 87% of security teams prioritize the adoption of agentic AI, with 77% expressing comfort allowing AI to act without human review. This indicates a significant organizational move towards autonomous AI systems, even as the expert rankings of potential risks associated with these agents show a statistically insignificant agreement with the incident record.
What to Do with This on Monday
The immediate takeaway for security professionals and organizational leaders is a call for a behavioral shift, not necessarily a radical overhaul of existing strategies, but a focused re-evaluation of how AI risks are perceived and prioritized. The core question for any board or security committee meeting next is stark: "If our AI risk ranking is derived from a 29-person vote and a corpus that demonstrably disagrees with it, what are we actually using to decide which controls get funded next year?" This question cuts to the heart of evidence-based security decision-making in the rapidly evolving domain of AI.
