# The OWASP LLM Top 10 has a few surprises for you

## Executive summary

The discussion analyzes emerging risks in AI security, highlighting a shift from focusing solely on prompt manipulation to addressing 'Excessive Agency'—the actions an autonomous system can perform. Key takeaways include the need for robust identity controls (least privilege, segmentation) when dealing with agentic systems and the necessity of operationalizing supply chain data via CISA's updated SBOM guidance. Experts emphasize that security must be built around AI models to ensure resilience when they inevitably fail.

## Key takeaways

- Shift in AI Risk Focus: Agency over Injection: The primary concern is shifting from manipulating what the AI says (prompt injection) to controlling what it actually does (excessive agency). Agents are viewed as privileged accounts that require strict identity and access controls.
- OWASP List for Tabletop Exercises: Instead of treating the OWASP LLM Top 10 list as a compliance checklist, panelists recommend using it as a framework for tabletop exercises to test detection, containment, and reconstruction capabilities during an attack.
- Operationalizing SBOM Data: CISA's updated SBOM guidance (2026 minimum elements) must move beyond being a compliance artifact. Organizations must integrate SBOM data with vulnerability/exposure management to determine *where* and *how* critical components are exposed in real-time, rather than just cataloging them.
- AI Agents as the New Attack Surface: The risk is no longer limited to software vulnerabilities; AI agents themselves constitute a new attack surface. Threat actors can exploit an agent's granted authority (e.g., via malicious calendar invites) through techniques like 'Intent Collusion.'

## Technical details

- OWASP LLM Top 10 (2026): The list identifies Prompt Injection and Sensitive Information Disclosure as the top two risks. Excessive Agency jumped to spot three, indicating growing concern over models taking actions beyond intended scope. The OWASP report used both community votes and real-world incident databases, noting discrepancies (e.g., low incidence rate for prompt injection vs. high practitioner concern).
- Excessive Agency & Identity Crisis: Agents are functionally similar to privileged accounts; they must have broad access to be useful. The core security challenge is balancing functionality/speed against security, leading experts to conclude that the industry faces an 'identity crisis' regarding how agents should be controlled and limited.
- CISA SBOM Guidance (2026): The new guidance requires recording not just direct dependencies but also dependencies of dependencies. The focus must shift from mere cataloging to operationalizing the data by linking it to vulnerability management and business context to determine actual risk exposure.
- Intent Collusion: A sophisticated attack technique where an attacker persuades an agent that their malicious goal is actually aligned with the user's intended objective, bypassing traditional security controls. This was demonstrated using a malicious calendar invite to manipulate an authenticated agent.

## Practical implications

- Implement the OWASP LLM Top 10 as a framework for tabletop exercises, focusing on detection and containment rather than just compliance.
- Prioritize implementing least privilege, segmentation, and hard boundaries when deploying autonomous AI agents to limit blast radius.
- Integrate SBOM data directly into vulnerability management programs. The goal is not inventory, but determining which components are exploitable in the current environment.
- Treat AI agents as high-privilege identities that require continuous monitoring for actions taken outside of user intent.

## Topics

AI Security, LLM Governance, Supply Chain Security, Cyber Resilience, Identity and Access Management, OWASP LLM Top 10 for 2026, CISA's SBOM guidance (2026 minimum elements), IBM Security Intelligence Podcast

Source: https://www.youtube.com/watch?v=auS34nm9VAc