OWASP Ranks Excessive Agency Third After Weighing 6,639 Real Incidents, and Publishes an Agent Control Standard

Not an incident. A ranking methodology change with direct bearing on how agent risk is measured

The OWASP GenAI Security Project formally released the 2026 Top 10 for LLM Applications alongside a new Agent Control Standard. For the first time the ranking weighed a corpus of real incident data against expert consensus: 7,714 incidents drawn from public vulnerability databases and an AI-harm database, of which 6,639 carried enough detail to classify. Excessive Agency moved from sixth in 2025 to third, the largest shift in the list, on the strength of that incident evidence. Eight of the ten entries changed position and one was renamed: the 2026 order is LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Excessive Agency, LLM04 Supply Chain, LLM05 Data and Model Poisoning, LLM06 Unbounded Consumption, LLM07 Misinformation, LLM08 Hidden Context Exposure (renamed from Prompt Leakage), LLM09 Vector and Embedding Weaknesses, and LLM10 Improper Output Handling, which fell from fifth to last. The Agent Control Standard (v0.1) defines an Agent Bill of Materials and OpenTelemetry and OCSF-based tracing for runtime governance of autonomous agents, with a crosswalk to AICM, ISO 42001, and NIST AI RMF. The document passed 10,000 downloads in its first 48 hours

Not applicable. The finding worth recording is the direction of the evidence: when the list is weighted by what actually happened rather than by what practitioners expect, the categories that move up are the ones about agents taking actions, and the category about mishandling model output moves to the bottom