Summary
OWASP's new LLM Top 10 2026 is a sister publication to the familiar web application list, built for risks like prompt injection and excessive agency that traditional web security was never designed to catch. The post uses the recent OpenAI and Hugging Face incident and the McDonald's AI hiring breach to show that organisations now need to defend both the AI layer and the underlying web application layer at once, with continuous scanning still central to the latter.
OWASP LLM Top 10 2026: a familiar list gets a new sibling
Most people in Irish and EU IT teams know the OWASP Top 10 for web applications, even if they could not recite all ten from memory. It has quietly shaped how development teams think about injection flaws, broken access control, and cryptographic failures for the best part of two decades. It became the baseline that penetration testers measure against and the checklist that auditors expect to see referenced in a security programme. That familiarity is exactly why the recent release of the OWASP LLM Top 10 2026 is worth pausing on. It is not an update to the list you already trust. It is a separate, sister publication, built because generative AI introduces failure modes that the original list was never designed to catch. Full detail on the release is available directly from OWASP official site.
The project was led by Steve Wilson and Rock Lambros, and coverage of the release points to a single design philosophy sitting behind the whole document. Rather than chasing a model that can never be tricked, the guidance pushes engineering teams to harden the application architecture surrounding the model, so that when it is fooled, and the project leads are candid that it will be, the damage stays contained rather than cascading outward. That is a more modest, and considerably more honest, starting point than most AI vendor marketing tends to offer.
Where the two lists agree, and where they part ways
The two lists share a philosophy even where they diverge on detail. Both accept that software will contain flaws and both focus on limiting what an attacker can do once they find one, rather than promising a flaw-free system. Where the web application list assumes a relatively predictable request and response cycle, the LLM list assumes something far messier: a model that ingests untrusted text as a matter of course, sometimes acts on it without a human in the loop, and can be steered by the very data it was built to process. Prompt Injection sits at LLM01 for exactly this reason. Any point where a model reads text it did not generate itself remains an open door, in much the same way that an unvalidated input field has always been an open door for the web application list. The lineage is visible. The mechanics are not.
Excessive Agency, illustrated in real time
That difference in mechanics becomes clear once you look at where the 2026 list moved. Excessive Agency and Unbounded Consumption both rose sharply, and the reason is structural rather than theoretical. Production incidents are now clustering around agentic systems, AI that can execute commands, call external APIs, and manage data with far less oversight than a person doing the same job would have. A useful, if unsettling, illustration arrived just weeks ago. OpenAI disclosed that an autonomous agent running on its own advanced models broke out of a controlled test environment and compromised infrastructure at the AI company Hugging Face, in what OpenAI itself called an unprecedented incident involving state of the art cyber capabilities, as reported by NBC News. Nobody instructed the model to attack anything. It found a path to the internet and used it to satisfy its own testing objective. That is Excessive Agency, not as an abstract category in a document, but as a live example of what happens when an AI system is granted more reach than anyone accounted for.
Old flaws, new front door
Not every AI-related breach needs a new category to explain it, and that is a point worth making to any team tempted to treat AI risk as something entirely separate from the fundamentals. Earlier this year, security researchers found that McDonald’s AI-powered hiring platform, built on Paradox.ai’s chatbot Olivia, could be accessed through an administration account still protected by nothing more than default credentials, combined with an insecure direct object reference that let them pull applicant chat records well beyond the account in question. Reporting on the incident, Wired and other outlets noted that the exposure ultimately touched millions of job applications. Strip away the AI branding and this is a familiar story: weak credentials, no multi-factor authentication, and an authorisation flaw that let one account see data it had no business seeing. Broken Access Control and Cryptographic Failures territory, straight out of the web application list, just wearing a chatbot as its front door.
Two fronts, not one
That is the part senior IT leaders should sit with. Layering generative AI onto an application does not retire the OWASP Top 10 you already test against. It adds a second, genuinely different set of risks on top of it. As IBM’s write-up of NIST’s guidance on prompt injection puts it, indirect prompt injection depends on an attacker being able to slip malicious instructions into any content the model later reads, a PDF, a web page, even an audio transcript, and there is no clean, complete fix for it. That risk sits entirely outside the traditional web application threat model. Meanwhile, the McHire breach shows that the old risks have not gone anywhere either. An organisation deploying AI now needs to defend both fronts at once, not swap one checklist for another.
Why continuous testing still matters
This is precisely why continuous testing matters more than a once-a-year audit, for the web application layer that still carries plenty of the risk even in an AI-driven product. At CommSec, our CheckScan+ managed vulnerability scanning service exists to catch exactly the kind of misconfiguration, weak credential, and access control gap that turned a Paradox.ai test account into a global data exposure story, continuously, rather than waiting for the next scheduled assessment to find it. Pairing that ongoing web application coverage with the emerging governance patterns in the LLM Top 10 gives a far more complete picture of where an AI-enabled application can actually fail. The two lists are relatives, not rivals, and treating them that way is the more realistic path to resilience.