The OWASP LLM Top 10 has a few surprises for you
Summary
The discussion analyzes emerging risks in AI security, highlighting a shift from focusing solely on prompt manipulation to addressing 'Excessive Agency'—the actions an autonomous system can perform. Key takeaways include the need for robust identity controls (least privilege, segmentation) when dealing with agentic systems and the necessity of operationalizing supply chain data via CISA's updated SBOM guidance. Experts emphasize that security must be built around AI models to ensure resilience when they inevitably fail.
Key takeaways
-
Shift in AI Risk Focus: Agency over Injection
20:55
The primary concern is shifting from manipulating what the AI says (prompt injection) to controlling what it actually does (excessive agency). Agents are viewed as privileged accounts that require strict identity and access controls.
-
OWASP List for Tabletop Exercises
21:05
Instead of treating the OWASP LLM Top 10 list as a compliance checklist, panelists recommend using it as a framework for tabletop exercises to test detection, containment, and reconstruction capabilities during an attack.
-
Operationalizing SBOM Data
21:45
CISA's updated SBOM guidance (2026 minimum elements) must move beyond being a compliance artifact. Organizations must integrate SBOM data with vulnerability/exposure management to determine *where* and *how* critical components are exposed in real-time, rather than just cataloging them.
-
AI Agents as the New Attack Surface
The risk is no longer limited to software vulnerabilities; AI agents themselves constitute a new attack surface. Threat actors can exploit an agent's granted authority (e.g., via malicious calendar invites) through techniques like 'Intent Collusion.'
Technical details
-
OWASP LLM Top 10 (2026)
126s
The list identifies Prompt Injection and Sensitive Information Disclosure as the top two risks. Excessive Agency jumped to spot three, indicating growing concern over models taking actions beyond intended scope. The OWASP report used both community votes and real-world incident databases, noting discrepancies (e.g., low incidence rate for prompt injection vs. high practitioner concern).
-
Excessive Agency & Identity Crisis
1265s
Agents are functionally similar to privileged accounts; they must have broad access to be useful. The core security challenge is balancing functionality/speed against security, leading experts to conclude that the industry faces an 'identity crisis' regarding how agents should be controlled and limited.
-
CISA SBOM Guidance (2026)
1305s
The new guidance requires recording not just direct dependencies but also dependencies of dependencies. The focus must shift from mere cataloging to operationalizing the data by linking it to vulnerability management and business context to determine actual risk exposure.
-
Intent Collusion
A sophisticated attack technique where an attacker persuades an agent that their malicious goal is actually aligned with the user's intended objective, bypassing traditional security controls. This was demonstrated using a malicious calendar invite to manipulate an authenticated agent.
Mentioned resources
- OWASP LLM Top 10 for 2026
- CISA's SBOM guidance (2026 minimum elements)
- IBM Security Intelligence Podcast
Channel & topics
Watch on YouTube · Back to latest
This independent, AI-assisted summary is provided for commentary and informational purposes. It may contain errors or omit important context. Please watch the original video for the creator's complete presentation. Video, thumbnail, and related copyrights belong to their respective owners.