The Open Web Application Security Project released its 2026 GenAI LLM Top 10, and “Excessive Agency” vaulted from sixth to third place. The jump matters because it shows the most dangerous failures are no longer limited to bad output, but to agents that can act on your infrastructure.

Why the shift matters

For the first time the Top 10 is built on a quarter of its data coming from actual incidents—more than 6,000 reported breaches, exploits and misbehaviors. Earlier editions relied almost entirely on expert opinion. Real-world signals show that when a language model can call APIs, execute code or move money, the consequences shift from embarrassing text leaks to concrete operational damage. Prompt injection still tops the list, followed by sensitive information disclosure, but the rise of “Excessive Agency” in the top three tells security teams the next wave of attacks will be tool-enabled rather than purely linguistic.

What “excessive agency” looks like

Excessive agency describes any situation where an LLM is given a capability it should not have, or more capability than the surrounding guardrails can contain. Typical examples include:

  • An assistant that invokes internal micro-service endpoints without a permission check.
  • A code-generation bot that writes and runs scripts on production servers.
  • A financial-automation agent that initiates transfers after a crafted prompt.

If a malicious prompt tricks the model while it holds such powers, the breach is immediate and often costly. The risk grows in proportion to the gap between the model’s ability to follow a prompt and the strictness of the surrounding controls.

How the new Top 10 was built

The 2026 edition blends expert judgement with hard data. Roughly 25 % of the ranking derives from the incident pool mentioned earlier, giving weight to patterns that actually manifested in the wild. This methodology change explains why “Excessive Agency” rose sharply: the data show a clear uptick in incidents where the model performed an action rather than just spitting out text.

Other notable moves

  • Hidden Context Exposure (renamed from “System Prompt Leakage”) climbs to cover a broader set of sensitive data, reflecting that attackers are increasingly mining model context for secrets.
  • Improper Output Handling falls to tenth place, suggesting that organizations are getting better at sanitising raw model responses. The industry’s focus is shifting from “the model said something bad” to “the model did something bad.”

These movements reinforce the narrative that the threat surface is expanding from static outputs to dynamic behaviors.

Mitigating the risk

Security teams can start reducing excessive agency with three practical steps:

  1. Scope your tools – Assign each agent only the actions it needs for its specific job. Avoid giving a single LLM a “full toolbox” for convenience; granular permissions limit the blast radius of a compromised prompt.
  2. Build guardrails in code, not prompts – Rely on explicit permission checks, confirmation gates and audit logs in the layer that actually executes the tool. Treat every model output as an untrusted request that must pass the same security review as any external API call.
  3. Inventory all tool combinations – Document which agents can access which APIs, scripts or financial endpoints. More important than the list itself is understanding how those capabilities interact; a harmless-looking pair of tools can become dangerous when chained together.

The updated Top 10 also maps each risk to major enterprise security standards, giving defenders a common language to discuss mitigation with compliance and audit teams.

Counter-point: is the risk overstated?

Some practitioners argue that “excessive agency” merely reflects poor design choices rather than an inherent flaw in generative AI. They point out that any programmable system can be misused if given unrestricted access, and that strong DevOps practices already address many of the highlighted scenarios. While discipline around permissions is essential, the data-driven rise of the risk suggests many organizations still lag in applying those practices to AI-augmented workflows.

What to watch next

  • Further Top 10 revisions – As more incidents are logged, the OWASP list will continue to evolve. Keeping an eye on the annual release will help teams anticipate where the threat curve is heading.

The message is clear: giving a language model the power to act is cheap; protecting against that power is expensive. Organizations that treat model output as a request, not a verdict, will stay ahead of the emerging wave of tool-enabled attacks.