OWASP's 2026 LLM Top 10: Excessive Agency jumps to #3

The OWASP GenAI Security Project announced on September 2 that its 2026 Top 10 for LLM Applications is out — 10,000 downloads in the first 48 hours — and that Excessive Agency now ranks third. It sat at sixth. The same announcement debuted the Agent Control Standard (ACS), an open spec for runtime agent control that was donated to the project. Read together, those two things say something specific: the industry's consensus risk list has stopped being about what models say and started being about what agents do.

What actually happened

The 2026 edition, as analyzed by Cloud Security Alliance Labs, ranks: Prompt Injection, Sensitive Information Disclosure, Excessive Agency, Supply Chain, Data and Model Poisoning, Unbounded Consumption, Misinformation, Hidden Context Exposure, Vector and Embedding Weaknesses, Improper Output Handling.

Two changes matter beyond the Excessive Agency move. Misinformation climbed from ninth to seventh. And System Prompt Leakage is gone as a standalone entry, folded into a broader Hidden Context Exposure category at eight — a sensible correction, because your system prompt was never the only context an attacker wanted.

CSA's read of the methodology is that the list is no longer a pure vote. It weights 75% practitioner consensus against 25% empirical incident data, drawn from 6,639 documented real-world incidents in public vulnerability databases and an AI-harm database. Excessive Agency didn't climb because the committee had a feeling. It climbed because agents started shipping and things started breaking.

The Agent Control Standard is the more actionable half. The public repo is at v0.1 public preview, Apache-2.0 for code and CC BY-SA 4.0 for docs. It specifies three properties an agent needs to be trustworthy — inspectable, traceable, instrumentable — and defines declarative hooks plus a guardian-agent enforcement pattern to get them. Observability rides on OpenTelemetry and OCSF. An Agent Bill of Materials (AgBOM) exposing dynamic agent composition via CycloneDX, SWID and SPDX is slated for v2. Framework instrumentation for FastMCP clients and A2A is on the roadmap.

Why the OWASP LLM Top 10 2026 matters for your business

Excessive Agency is the plainest risk on the list and the one small teams ship the most of. It's what happens when an agent has a tool it didn't need, a permission scope nobody trimmed, or the ability to act where it should only have been able to draft. The support agent with write access to the CRM. The ops agent holding a token that can also touch billing. Nobody decided that. It's just what the credential already had.

The ranking move is a good forcing function. Go read your own agents this week and answer three questions per tool: what can this call, what is the worst single action it can take, and who sees it after the fact. If the answer to the third is "nobody," you don't have an agent — you have an unlogged service account with a chat interface.

ACS at v0.1 is not something to bet a production system on. But its three properties are free to adopt today without the spec: log every tool call with the reasoning that triggered it, keep an inventory of which models and tools each agent can reach, and put an enforcement point between the agent and anything irreversible. That's the same deny-by-default posture we've been writing about all year, now with a standards body behind it.

Sources: OWASP GenAI Security Project, Cloud Security Alliance Labs, Agent Control Standard on GitHub.