Behind the new OWASP ranking of AI risks sit 7,714 real incidents. The group collected them from public vulnerability databases, found 6,639 with enough detail to classify, and for the first time weighed that record against what practitioners voted. Votes counted for three-quarters of the final order, incident data for one-quarter.
EQUES, a startup from the University of Tokyo’s Matsuo Lab, summarized the result this week for readers. The 2026 edition of the LLM Top 10, released in August, keeps all ten items. Eight changed rank and one was renamed.
Prompt injection holds first place
Prompt injection stayed at number one, and the reason is odd. Ranked purely by public incidents, it would not make the top ten. OWASP explains that companies are working hard on defenses, so successful attacks are less visible, and it kept the item on top. Misinformation, the hallucination risk, showed the opposite pattern: lower in the vote, higher in the incident record, the widest gap between the two.
The biggest mover is Excessive Agency, which climbs from sixth to third. Both votes and incidents point to damage in agent-style setups, where AI is handed tools and permission to act. Unrestricted Consumption rises four places to sixth, because reasoning models and agents turn one request into a chain of further work and rate limits alone no longer stop runaway bills. Misinformation moves to seventh. When an answer feeds straight into a tool or a decision, a wrong sentence becomes a wrong action.
System Prompt Leakage is now Exposure of Hidden Context. The scope covers anything the model can see and the user cannot, such as internal rule documents pulled in through retrieval and tool definitions. The advice is to assume it will be found and never put passwords or keys there.
The real cases behind the list
Examples gathered around the release show what these categories cost. A June 2026 paper tested 1,200 LLM applications on six commercial platforms and found over 80% leaked their system prompts under realistic attack queries, in some cases with API keys for outside services. In August the research group METR described a case where stolen API keys paid for three weeks of AI use, roughly $600,000 in commercial credits. In June a federal district court in Mississippi removed four lawyers from a case and fined them for a filing that cited precedents that do not exist. The lawyers admitted they had used AI and never checked.
EQUES boils the defenses down to three habits: keep protections outside the AI, hand over as little authority, information and money as possible, and verify what goes in and what comes out. Prompt injection cannot be fully prevented while an input field exists, the report says, so authorization and guardrails cannot rest on the model’s judgment.
Ransomware aimed at AI
A separate tool arrived the same week. Behnaz Karimi, co-lead of OWASP’s AI Bill of Materials initiative, spent two years building the Ransomware Assessment and Incident Defense Framework for AI Systems, or RAID-AI, with fellow co-lead Yuvaraj Govindarajulu. They had meant to unveil it at the ISC2 Security Congress in Denver on October 26 to 28, but visa trouble kept Karimi away.
It is free and works through a web console. Security teams grade their own controls from zero to five, across general areas such as recovery, training and sensitive-data protection and AI-specific ones covering data, tools and runtime. Nothing connects to company systems, so it is a readiness check rather than an audit. The scores map to NIST Cybersecurity Framework 2.0 and CISA’s Cybersecurity Performance Goals 2.0, with attack mapping through MITRE ATT&CK, MITRE ATLAS and NIST Adversarial.
“Right now, we are slowly seeing that ransomware attacks targeting AI systems are happening,” Karimi said. She pointed to an April 2025 report by Zoran Mitrovic of Kintra Health on data poisoning by ransomware actors, and to an alleged June 2026 attack on Novo Nordisk in which hackers claimed to have taken the company’s AI models.
Volunteers holding the floor up
Underneath it all, the plumbing is creaking. Flaws nicknamed PHP2Shell sat in PHP for more than a decade before advanced AI models made them exploitable. PHP runs about 70 percent of the world’s websites. Government and corporate sites briefly went offline to patch.
“There’s been a lot of people in the AI safety community that said this is one of the first areas where we are going to see the harmful impact of AI,” said Peter Slattery of MIT’s FutureTech. The PHP Foundation runs on a meager budget. Amanda Brock, CEO of OpenUK, said it is “simply not possible with the resources in place to fix all of the known vulnerabilities.”
Jarek Potiuk, a volunteer on the Apache Software Foundation’s security team, says his group has maybe ten times more issues than usual because AI is finding them. Mozilla logged more than 400 vulnerabilities in April, up from a previous record of 76 the month before.
Sources
- [Special Edition] The 10 Major AI Risks Announced in the Latest 2026 Report: A Summary of the OWASP LLM Top 10 and the New Ranking Table｜株式会社EQUES公式｜東大松尾研発スタートアップ
- OWASP
- Why AI could threaten much of the world’s digital infrastructure
- New Framework Puts Ransomware Resilience for AI Systems in Focus
- Kazakhstan Ranks 41st Worldwide for Public Order and Security, Global Index Shows – The Astana Times
- – 9 GitHub Projects To Explore As Alternatives To Popular AI And Business Apps
Photo: Zulfugar Karimov / Unsplash (Unsplash License)
