By Robin Martherus
The 2026 OWASP Top 10 for LLM Applications landed on August 3. Most coverage read it as a reshuffle. It is more than that, and the most important sentence in it is not a risk category at all.
It is a boundary.
“This list owns the risk when the model is a component inside your application. The moment that model becomes an actor, with tools it can call, memory it carries between sessions, and consequences it sets in motion downstream, the risk moves to the OWASP Agentic Top 10. … Read an entry here for the model-as-component failure. When your model starts acting on its own, pair it with the Agentic list, because neither one covers that ground alone.”
That is a standards body saying, in writing, that agentic security has layers, and that the lower one does not reach the upper one. It is the right call. It is also an admission that should change how the industry talks about “complete” AI security platforms.
There are two lists now, not one. The LLM list covers the model as a component. The Top 10 for Agentic Applications, released last December, covers the model as an actor: ASI01 through ASI10, from Agent Goal Hijack to Rogue Agents. Read either alone and you will misjudge your exposure.
That split is worth sitting with, because drawing it once invites the question of where else the seams fall. I mapped one version of that in The Three Domains of Agentic Security — the point being that “AI security” is not one discipline, and treating it as one is how coverage gaps get built into architectures by default. OWASP has now conceded the first seam. It is unlikely to be the last.
What Moved, and Why It Matters
The LLM list reordered more than usual, and this year the ordering was checked against incident records rather than sentiment alone.
- Excessive Agency: 06 → 03. The largest climb on the list.
- Unbounded Consumption: 10 → 06. Up four places.
- Improper Output Handling: 05 → 10. The largest fall.
- Hidden Context Exposure. Renamed and broadened from System Prompt Leakage. Now covers every non-user-visible context, not just the system prompt.
OWASP’s stated reason for the Excessive Agency climb is blunt: “the vote and the record agree that agentic deployments are where the damage is landing.”
Read those four moves together and a pattern appears. The risks that involve the model doing things went up. The risks that involve the model saying things went down. The field’s damage is migrating from output to action.
That is exactly the migration the second list exists to cover.
The Part I Did Not Expect
I have spent two years arguing that credentials answer can, and that agents also require why and should. Purpose has to be declared, bound, and checked against behavior — not left as a line in a system prompt.
That argument is now inside an OWASP document, as named mitigations.
“evaluate use of ‘intent capsule’, an emerging pattern to bind the declared goal, constraints, and context to each execution cycle in a signed envelope, restricting run-time use.” — ASI01, Agent Goal Hijack
“Policy Enforcement Middleware (‘Intent Gate’). Treat LLM or planner outputs as untrusted. A pre-execution Policy Enforcement Point validates intent and arguments, enforces schemas and rate limits, issues short-lived credentials, and revokes or audits on drift.” — ASI02, Tool Misuse and Exploitation
“Define Intent: Bind OAuth tokens to a signed intent that includes subject, audience, purpose, and session. Reject any token use where the bound intent doesn’t match the current request.” — ASI03, Identity and Privilege Abuse
“Adaptive Trust Calibration: Continuously adjust the level of agent autonomy and required human oversight based on contextual risk scoring.” — ASI09, Human-Agent Trust Exploitation
“Attach signed behavioral manifests declaring expected capabilities, tools, and goals that are validated by orchestration services before each action.” — ASI10, Rogue Agents
Purpose bound to a token. Intent checked before execution, not after. Autonomy modulated by computed trust instead of granted once. Behavior measured against a declared manifest. These are not adjacent ideas anymore. They are peer-reviewed mitigations in the reference document your auditor will cite next quarter.
That settles a debate. Nobody now has to argue that intent verification belongs in the architecture.
Which is why the gap is worth naming carefully.
Twenty Categories. Zero Normative Ones.
Count them. LLM01 through LLM10, ASI01 through ASI10. Twenty risk categories describing how agentic systems fail. Not one of them asks whether an action the agent is fully authorized to take, correctly declared in advance, and accurate in its facts, is an action that should be taken at all.
Three entries come close, and the way each falls short is instructive.
ASI10, Rogue Agents, is about behavioral integrity. It measures the agent against a manifest the agent itself declared. That catches drift from the declaration. It cannot catch a declaration that was harmful when it was written.
ASI09, Human-Agent Trust Exploitation, is about humans over-trusting fluent, confident agents. Real problem, well described. But it is a human-factors and social-engineering entry. It asks whether the person should have believed the agent, not whether the action was permissible.
LLM07, Misinformation, is about accuracy. An agent that is precisely correct about the wrong thing passes it cleanly.
Every one of the twenty asks a variant of: was this authorized, was this declared, did this conform, was this true. None asks: given that all of that passed, should it happen?
The transfer that is valid and in-scope and correctly declared, executed on the morning an employee enters their notice period. The data pull that is authorized, purposeful, accurate — and crosses a litigation hold. The clinical recommendation from a trusted agent that is right on the medicine and wrong on the consent status.
These are not detection failures. Nothing in the twenty categories has a place to put them, because they are not security defects. They are governance defects that manifest through a perfectly healthy security stack.
I wrote about that class of failure in The Agent Did What It Said It Would Do. It Was Still Wrong. and again in The Agent Passed Every Security Check. It Still Shouldn’t Have Acted. The 2026 lists are the strongest evidence yet that the industry has no shared name for it.
Two Problems OWASP Names and Declines to Solve
The lists are honest about their limits in two places, and both of those limits matter more than the categories around them.
Intent fragments across agents, and typed contracts do not fix it
ASI07, Insecure Inter-Agent Communication, includes this attack scenario:
“Semantics split-brain: A single instruction is parsed into divergent intents by different agents, producing conflicting but seemingly legitimate actions.”
That is the failure mode I described in The Guardrail Never Saw the Whole Prompt. One purpose, decomposed across a swarm, where every fragment reads as benign and only the composition is harmful.
Then the mitigations section says this:
“Typed contracts help with structure, but semantic divergence across agents remains an inherent challenge; mitigations therefore focus on integrity, provenance, and controlled communication patterns rather than attempting full semantic alignment.”
Read that again. Signed messages, verified provenance, pinned protocols — all necessary, all recommended. And an explicit statement that they do not resolve the semantic problem, which the document sets aside as inherent.
I do not read that as a failure of the working group. I read it as a correct scoping decision and an open invitation. You cannot solve composite intent at the message layer, because the message layer has no representation of the whole. It has to be solved where the composition exists: above the transport, at the layer that can evaluate a session as a unit rather than a request at a time.
Human approval is the top mitigation, and it cannot keep pace
Human-in-the-loop appears as a recommended control in ASI01, ASI02, ASI03, ASI06, ASI09, and LLM03. It is the most-repeated mitigation across both lists.
ASI08, Cascading Failures, then says this:
“these compounding threats illustrate a potential discrepancy in the speed and scale of fault propagation in a multi-agent system and the ability of humans to keep up with them to ensure secure and effective operation of the system. This leaves some unmitigated risks that the enterprise must evaluate carefully to ensure they are within the overall risk budget for the organization.”
That is a residual risk disclosure. It says the primary control does not scale to the threat, and hands the remainder to the enterprise’s risk appetite.
I made the same argument in Human in the Loop Is Not an Agentic Governance Strategy, and I would rather have been wrong. A human approving one action at a time cannot govern a system that fans out in milliseconds. When the only thing standing between a poisoned planner and a hundred downstream executions is a person reading a dialog box, the fan-out wins.
Something has to hold the line at machine speed, and it has to be something other than the agent’s own judgment. That is a layer, not a checkbox.
The Vocabulary Risk
Here is my worry about the good news.
“Intent capsule.” “Intent Gate.” “Purpose-bound token.” “Signed behavioral manifest.” Those phrases are now in a document that every AI security vendor will read this month. Within a quarter, “intent-aware” will be on slideware across the category.
We have watched this happen. Zero Trust went from a specific architectural claim to a marketing adjective in about three years, and buyers lost the ability to tell implementations apart. Vocabulary capture without mechanism is how a good idea gets neutralized.
Notice what the lists give you and what they do not. They give you the name of the control. They do not give you the format of an intent capsule, the schema of a behavioral manifest, the wire representation of a trust observation, or the decision type a normative veto emits. A mitigation bullet is not a contract. Two products can both claim “Intent Gate” and share nothing an auditor could compare.
I argued in Agent Identity Standards Are Not Sufficient that standards should define sockets, not furniture. The 2026 lists just made the sockets urgent. They named the plugs and left the pinouts undefined.
What Should Happen Next
OWASP and the standards community. The agentic list is the right vehicle and the working group has clearly earned its credibility. Two specific asks. First, promote the ASI07 semantic-divergence note from a scoping caveat to a chartered problem statement — composite intent is a distinct failure class, not a residue of message security. Second, look at whether the twenty categories need a twenty-first, or whether normative constraint belongs in a companion document. Either answer is defensible. Having no answer is what leaves the whole class unaddressed.
Vendors. Publish the schema behind whatever you are calling an intent capsule. If your purpose binding cannot be read by another vendor’s policy decision point, you have implemented a feature, not a mitigation. And bind it to the action, not the role — I made that case in Stop Writing Policies for Agents. Write Policies for Actions. The lists will be used as a checklist in procurement within two quarters. Be ready to show the format, not the phrase.
CISOs and buyers. Ask two questions in your next agentic AI review. Show me where intent is bound and re-checked before the action, not logged after it. And show me what happens when the action is authorized, in scope, and accurate, and still violates an obligation the business has. If the answer to the second is a runbook, you do not have a control. You have a hope with a ticket number.
Builders and researchers. The most valuable contributions right now are boring ones: fixture vectors, cross-vendor test scenarios, a shared representation for what an agent declared versus what it did. The lists established the requirement. Somebody has to write the interoperable form of it, in the open, where it can be argued with and forked.
The Bottom Line
The 2026 OWASP GenAI lists are a real advance. They separate the model-as-component from the model-as-actor, they rank on evidence instead of sentiment, and they put intent verification, purpose binding, and computed trust into the industry’s shared reference.
They also, across twenty categories, never ask whether an authorized action should happen. They name composite intent as an attack and set it aside as inherently hard. And they lean hardest on the one mitigation they concede cannot keep up with the threat.
None of that is a criticism of the work. A Top 10 is a description of where damage has landed, and the damage that has landed so far is security damage. The governance failures are arriving next, and they will pass every one of these controls on the way in.
The industry now has an agreed language for everything below the line and no language at all for what sits above it. The gap is documented, in a source everyone cites, by people who were careful enough to say where they stopped.
That is the best possible starting condition. We should not waste it arguing about who noticed first.
Tamed Autonomy is an independent personal research project exploring AI agent governance beyond identity and authorization. Related notes: the should layer, layered cooperative enforcement, human-calibrated autonomy, and the whitepaper.
Leave a Reply