Prompt injection has topped OWASP’s Top 10 for LLM Applications for three straight years, but a new analysis shows it ranks only No. 12 in labeled real-world incidents. The disparity stems from the attack’s invisible nature—it manipulates models via trusted content like logs or documents, leaving no CVE trail for scanners to detect.
The study, published on arXiv by OWASP project leaders Kyriakos Lambros and Steve Wilson, compared 6,639 labeled incidents against expert rankings. The results showed no statistically significant agreement between the two methods, with Cohen’s kappa at 0.20. Wilson, Chief AI Officer at Exabeam, warns that incident data is backward-looking and may miss emerging threats like prompt injection, which he compares to an unavoidable “law of physics” for LLM systems.
Defenses focus on architectural controls rather than scanning. Wilson recommends authorization gates that block high-impact actions even if the model is fooled, while Lambros argues for early investment in agent memory and tool boundaries to prevent silent failures. The paper highlights gaps in both expert surveys and incident classification, with taxonomy flaws and weak classifier precision undermining reliability.
The OWASP 2026 list, released August 4, already weights incident data at 25%, but prompt injection retained its No. 1 spot. The authors stress that low advisory counts may reflect undetected attacks, not effective defenses.
