Prompt injection ranks No. 1 with OWASP and No. 12 in the incident record. The attack itself is invisible to a scan. A CISO who sees a low CVE count and deprioritizes prompt injection is reading the scoreboard wrong.
Prompt injection has held the No. 1 spot on the OWASP Top 10 for LLM Applications for three consecutive years.
When two leaders of that list checked it against 6,639 labeled real-world incidents, it came back at No. 12. The drop measures visibility rather than danger, because the attack operates where a vulnerability scanner cannot see it.
Kyriakos “Rock” Lambros and Steve Wilson, two leaders of the OWASP Top 10 for LLM Applications project, found that the attack chain a scanner never logs is structural. Prompt injection hides instructions inside the content a model reads, anything from a local AI computer log entry to a support ticket to a document pulled back by retrieval.
The agent then makes the tool call the attacker wanted, using credentials it legitimately holds. Nothing in that chain is a product defect, so the attack leaves no CVE behind for a scanner to find.
The defenses that catch it are adversarial tests against the deployed system and hard caps on what the agent can reach, so a fooled model cannot touch anything expensive.
Related: Nvidia simplifies AI with basic math approach
Expert judgment and the public incident record disagree with each other. Cohen’s kappa comes in at 0.20 with a 90% interval running from negative 0.16 to 0.57.
Lambros said, “We had two ways of measuring the same risk, expert judgment and the public incident record, and they disagree with each other. Neither one is the truth.”
Wilson named the control he would deploy first against the attack chain, an agent that reads an attacker’s payload in a log file, treats it as an instruction, and rewrites DNS with a valid credential.
Wilson said, “The first thing I’d do is put an authorization gate outside the model: the agent can propose the exact DNS change, but it cannot grant itself the authority to make it.”
The authors flag their own measurement problems first. The expert side is thin, with only 29 respondents scoring each candidate risk on importance.
Twenty-nine votes set the ranking that carries three-quarters of the published list’s weight, the compression point for OWASP’s more than 25,000 community members. The classifier is the weak joint, with precision varying sharply across entries.
Lambros lays the weak kappa at the feet of the taxonomy itself. “That number is telling you about our categories, not about our experts,” he said.
Related: NAC remains relevant in SASE discussions
Use the OWASP LLM Top 10 as a coverage map, not a queue. The rank positions carry 29 votes and a corpus whose own authors call the agreement weak, so build your own priority order from your own exposure.
Log what your AI systems are actually doing, field by field. The prompt that went in, what came back out, the documents pulled to build the answer, the tools called and the arguments passed to them, and the model’s confidence score on every response, are all important.
Confidence is the field Lambros would fight for, because most security leaders do not realize it is measurable, and it is where the attack surfaces. “A model running on a poisoned instruction doesn’t act broken. It acts certain,” he said.
Kayne McGladrey, an IEEE senior member who advises enterprises on risk, put the funding logic bluntly. “Anything that seems to have a cybersecurity flavor is generally put into the cybersecurity risk category, which is a complete fiction,” McGladrey said.
They should be focused on business risks, because if it doesn’t affect the business, like a financial loss, then nobody’s going to pay attention to it, and they will not budget it appropriately.
A rank number from a 29-person vote is a weaker budget argument than the business system the agent touches. The board question for the next meeting is short: what are we actually using to decide which controls get funded next year?
