OWASP debuts an Agent Control Standard beside its 2026 LLM top 10

The OWASP GenAI Security Project announced an Agent Control Standard on September 2, 2026, alongside an expanded set of resources for its 2026 Top 10 for LLM Applications. The standard addresses software that acts on its own rather than only generating text. That is the gap most AI security guidance has left open.

OWASP is a long-running nonprofit whose top 10 lists became the default security checklist for web applications. Its LLM list plays the same role for AI software.

The 2026 top 10, in order

Cyber Security News published the full ranked list. Prompt injection stays at number one.

Rank	Risk
LLM01	Prompt Injection
LLM02	Sensitive Information Disclosure
LLM03	Excessive Agency
LLM04	Data and Model Poisoning
LLM05	Improper Supply Chain
LLM06	Insecure Output Handling
LLM07	Vector and Memory Flaws
LLM08	Misinformation
LLM09	Hidden Context Exposure
LLM10	Unbounded Consumption

One entry changed name. Cyber Security News reports that System Prompt Leakage was renamed and expanded into Hidden Context Exposure, now LLM09. The broader name covers more than a leaked system prompt.

Excessive Agency at number three is the placement worth noting. It describes an AI system granted more permission, autonomy or reach than the task requires. Its position near the top matches the arrival of the Agent Control Standard.

A caution on comparisons: none of the sources reviewed publishes the full 2025 ranking next to the 2026 one, so this article does not claim how far individual entries moved.

How the ranking was built

The method changed, and that is arguably bigger news than the order.

Cyber Security News reports that the 2026 edition draws on 7,714 real AI-related security incidents, collected from public vulnerability databases and AI-harm repositories. Rankings weighted community voting at 75% and that incident data at 25%.

Earlier editions rested on expert judgment. Now a quarter of the weight comes from things that actually happened. OWASP describes the approach as testing community expertise "against thousands of real-world incidents."

The OWASP project page says the guide was built with contributions from hundreds of AI security experts. It maps to other frameworks including NIST, MITRE ATLAS and CWE, plus OWASP's separate Top 10 for Agentic Applications. That second list is a different document, covering systems that act autonomously, and should not be confused with this one.

What the Agent Control Standard adds

The new standard was donated to the project rather than written inside it, according to the announcement.

The announcement describes it as extending guidance toward "practical runtime enforcement" covering identity, governance and testing for agentic systems. The published material stops there. It does not specify which controls the standard actually requires, so treat the detail as unavailable until the document itself is read.

The reasoning behind it is stated plainly by the project's leadership. "AI is moving from models that generate content to agents that can act autonomously," said Steve Wilson, who founded the top 10 and serves as chief AI officer at Exabeam. Scott Clinton, the project's chair and co-founder, said generative AI security "has moved incredibly quickly from an emerging concern to an operational priority."

The 2026 top 10 passed 10,000 downloads within 48 hours. The project reports more than 30,000 members on LinkedIn, and named F5 and WitnessAI as new gold sponsors, with Evoke Security and Mondoo as new silver sponsors.

What this means for developers

Start with the design principle rather than the list. Cyber Security News summarizes the project's stance in one line. Teams should stop trying to build a model that "cannot be fooled." They should harden the architecture around it instead, so that a compromised model has contained downstream impact.

That is a concrete instruction. It means your defenses belong at the boundaries the model talks through, not inside the prompt. If your only protection against prompt injection is wording in a system prompt, you have built the thing OWASP is telling you not to build.

Audit agency first, given its rank. List every tool your agent can call, every credential it holds, and every action it can take without a human. Then remove what the task does not need. Excessive Agency is third on this list because that pruning rarely happens.

Two entries deserve attention if you run retrieval. Vector and Memory Flaws at LLM07 covers the store behind a retrieval system, and Hidden Context Exposure at LLM09 now covers more than the system prompt. Anything you put into context is potentially recoverable, including retrieved documents another user should never see.

The framework mappings are the practical shortcut for anyone already under a compliance regime. The 2026 edition maps to NIST, MITRE ATLAS and CWE. That lets you attach these risks to controls your organization already reports against. It beats running a separate AI security effort beside the existing one.