Editorial illustration for OWASP's Top LLM Risk, Prompt Injection, Ranks Low in Actual Incidents
Prompt Injection Overrated in Real LLM Incidents
OWASP's Top LLM Risk, Prompt Injection, Ranks Low in Actual Incidents
Prompt injection has topped the OWASP Top 10 for LLM Applications three years running, the kind of ranking that shapes budgets and patch priorities across security teams. But when two of the people who built that list checked it against a database of 6,639 labeled real-world incidents, prompt injection landed at No. 12, not No.
1. That gap is the subject of a paper Kyriakos "Rock" Lambros and Steve Wilson, both leaders of the OWASP Top 10 for LLM Applications project, posted to arXiv on August 18.
The two built their comparison from 7,714 LLM security incidents pulled from CVE, GitHub Security Advisories, OSV, and the AIAAIC AI-harm database, then labeled 6,639 of them against a 20-entry taxonomy and ran a Bayesian model to correct for classifier error before setting the resulting data-driven ranking against the expert-driven OWASP list. They are careful to flag the work as exploratory, not peer-reviewed, and not an official OWASP release that overrides the existing methodology. What they found instead is a mismatch between what security experts flag as most dangerous and what actually shows up, and gets recorded, in the wild.
Lambros, co-lead of the OWASP GenAI Security Project Top 10 for LLM Applications and director of AI standards and governance at Zenity, put the finding in evidentiary terms in written answers to VentureBeat. “We had two ways of measuring the same risk, expert judgment and the public incident record, and they disagree with each other. Neither one is the truth,” Lambros said.
Why this matters For developers and founders shipping LLM features, this is a reminder that compliance checklists and vulnerability scanners were not built to catch this class of attack. A CVE count of zero tells you nothing when the exploit lives inside natural language, not code. Lambros and his co-author aren't saying OWASP got it wrong; they're saying two different measurement systems answer two different questions, and mixing them up leads to bad prioritization.
If your security team points to a thin incident log as proof that prompt injection can wait, ask what that log actually tracks. Researchers building defenses should read the gap the same way: three years at No. 1 on OWASP's list means the attack surface hasn't shrunk, only that the industry has gotten decent at catching the obvious attempts.
The interesting work now is figuring out what "actively defended" really covers, and what it misses. Anyone treating a low incident rank as a green light is trusting a scoreboard that was never designed to keep score of this particular game.
Related Reading
Open Source D&B rebuilds 642 million‑business database after AI agents hit limits
Open Source OpenAI's GPT Transcribe Cuts Error Rate to 3.31%, Improving on GPT-4o
Open Source Study: 6.7% of Deepfake Requests on Hugging Face Targeted Children
From Archives Alabama AG Subpoenas OpenAI Over Safety Practices Following Hack
From Archives Fastino Drops GLiNER 2.5, Replacing Span Enumeration With Boundary Prediction
Common Questions Answered
Why does prompt injection rank differently in the OWASP Top 10 for LLM Applications compared to real-world incident data?
When researchers Kyriakos Lambros and Steve Wilson analyzed 6,639 labeled real-world incidents, prompt injection ranked at No. 12 instead of its consistent No. 1 position in the OWASP Top 10 list. This discrepancy reveals that expert judgment and actual incident records measure different aspects of risk, and neither alone represents the complete truth about LLM security threats.
What is the key finding of the arXiv paper posted by the OWASP Top 10 for LLM Applications leaders?
The paper demonstrates that two different measurement systems—expert judgment and public incident records—disagree significantly on which LLM vulnerabilities pose the greatest risk. The researchers argue that mixing these two measurement approaches leads to poor security prioritization decisions across organizations.
How should developers approach prompt injection vulnerabilities if traditional security tools don't detect them?
Developers should recognize that prompt injection exploits exist within natural language rather than traditional code, making them invisible to standard compliance checklists and vulnerability scanners. A CVE count of zero provides no meaningful security assurance when dealing with LLM-based attacks, requiring alternative assessment and mitigation strategies.
What does the gap between OWASP rankings and real-world incident data suggest about security prioritization?
The gap indicates that security teams may be misdirecting resources and budgets based on expert-consensus rankings that don't align with actual threat prevalence in production environments. This misalignment can result in overinvestment in defending against lower-risk vulnerabilities while underestimating threats that appear more frequently in real incidents.
Further Reading
- OWASP LLM Top 10 2026: 7714 Incidents Analyzed - Invicti
- Prompt injection remains top LLM threat, OWASP report finds - SC Media
- OWASP Keeps Prompt Injection Atop 2026 LLM Risks - LetsDataScience
- OWASP GenAI Exploit Round-up Report Q1 2026 - OWASP GenAI Security Project
- Indirect Prompt Injection Goes Operational – Lab Space - Cloud Security Alliance
