OWASP's 2026 LLM Top 10 and the New Agent Control Standard: What Agent Builders Must Change

OWASP's GenAI Security Project published the 2026 edition of its Top 10 for LLM Applications on August 3, 2026, then formally unveiled it on September 1-2 alongside a brand-new Agent Control Standard and a project community that has now passed 30,000 members. The list surpassed 10,000 downloads within its first 48 hours. The headline change is a single ranking move: Excessive Agency climbed from sixth to third place. That is the risk most specific to agents, and it is the one most teams still handle by hoping their prompt is persuasive enough. Here is how to turn the list into controls you can actually enforce. The list is not a compliance checkbox. It is a threat model, and this edition is specific enough to drive code.

From awareness to controls

1. Read the Top 10 as a Control Contract

The fastest way to waste the OWASP list is to read it as awareness material. Read it as a contract instead. Code sample 1 turns the 2026 risks into a machine-readable map, each one bound to a concrete control and a severity, with Excessive Agency marked critical. Committing this file next to your code turns a static document into something your pipeline can reason about, diff, and enforce. The 2026 edition also expands mappings to NIST, MITRE ATLAS, and CWE, so one policy can satisfy several frameworks at once. Notice that every risk in the map has an owner and a severity. That is deliberate: a control map without owners becomes a wish list, and a severity of critical is what lets your pipeline decide which findings block a release.

# controls/llm-top10.yaml — map every OWASP risk to a concrete control
version: "2026"
owner: platform-security
risks:
  LLM01_prompt_injection:      { control: input_sanitizer + output_encoder, severity: high }
  LLM02_sensitive_info:        { control: pii_redactor + response_filter, severity: high }
  LLM03_supply_chain:          { control: model_allowlist + sbom, severity: medium }
  LLM04_data_poisoning:        { control: dataset_lineage, severity: medium }
  LLM05_improper_output:       { control: sandboxed_renderer, severity: high }
  LLM06_excessive_agency:      { control: least_privilege + approval_gate, severity: critical }
  LLM07_system_prompt_leak:    { control: no_secrets_in_prompt, severity: high }
  LLM08_vector_weaknesses:     { control: tenant_scoped_retrieval, severity: high }
  LLM09_misinformation:        { control: citation_required, severity: medium }
  LLM10_unbounded_consumption: { control: rate_limit + token_budget, severity: high }
# Excessive Agency rose from 6th to 3rd place in the 2026 edition.
# Treat it as critical: it is the risk most specific to agents.

2. Guardrails Must Face Both Directions

Prompt injection (LLM01) is the top-ranked risk for a reason: it is the path through which almost every other failure becomes reachable. The mistake teams make is guarding only the input. Code sample 2 runs the same middleware on inbound prompts and outbound model or tool output, watching for both injection patterns and leaked secrets. Prompt injection arrives as data; secrets leave as data. Filter both directions and you close the most common hole in one cheap step. Two-direction guardrails also give you a cheap audit signal. Every trip is a data point about which prompts and which tool outputs your system genuinely struggles with, which is far more useful than a quarterly review of the list.

// guardrails.ts — one middleware for prompt injection and unsafe output
export function guardrails(text: string, direction: "in" | "out") {
  const rules =
    direction === "in"
      ? [/ignore (all )?previous instructions/i, /you are now\b/i, /system prompt/i]
      : [/sk-[A-Za-z0-9]{16,}/, /AKIA[0-9A-Z]{16}/, /-----BEGIN [A-Z ]*PRIVATE KEY-----/];
  for (const r of rules) {
    if (r.test(text)) {
      throw new Error(`Guardrail tripped (${direction}): ${r}`);
    }
  }
  return text;
}
// LLM01 is input-shaped; LLM02 is output-shaped.
// Run both directions on every request and every tool result.

3. Excessive Agency Is an Allowlist Problem

Excessive Agency moved to third place because 2026 is the year agents got hands. A chatbot that says something wrong is embarrassing; an agent with wildcard scopes that runs a refund is expensive. Code sample 3 is the fix that has nothing to do with prompting: an explicit tool allowlist with per-tool scopes, deny-by-default, and an escalation rule requiring human approval above a threshold. If a tool is not listed, the agent cannot call it. That is a guarantee a clever prompt can never provide. The allowlist also shrinks your incident response. When an agent misbehaves, the question becomes which of five scoped tools it used, not which of a hundred capabilities it might have reached.

# tools.yaml — an explicit allowlist beats a model's good intentions
agent: support-triage
tools:
  - name: crm.read_customer
    scopes: ["customer:read"]
    max_rows: 1
  - name: kb.search
    scopes: ["kb:read"]
  - name: ticket.create
    scopes: ["ticket:write"]
    requires_human_approval: true
deny_by_default: true
escalation:
  - action: refund.create
    rule: "amount > 50 must be approved by a human"
# Least privilege is the concrete implementation of LLM06 Excessive Agency.
# If a tool is not listed, the agent simply cannot call it.

4. The Agent Control Standard Makes Agents Auditable

The new Agent Control Standard is best understood as a governance layer that sits between an agent and everything it touches. Code sample 4 sketches the shape: intercept tool calls, data egress, and model calls; return allow, deny, or route-to-human decisions; attach a per-agent workload identity; and keep an immutable audit trail. The point of the standard is not restriction for its own sake. It is that you cannot govern what you cannot see or stop, and most 2026 incidents are discovered long after the agent has already acted. The key design property is reviewability. Because every decision is a record with an identity and a policy attached, an auditor can reconstruct an agent's entire session without asking an engineer to translate logs from three systems.

// acs-gateway.json — where the Agent Control Standard intercepts
{
  "intercept": ["tool_call", "data_egress", "model_call"],
  "decisions": {
    "allow":   { "log": "full" },
    "deny":    { "log": "full", "alert": "#ai-security" },
    "review":  { "route": "human-in-the-loop", "timeout_s": 300 }
  },
  "identity": "per-agent-workload-id",
  "audit": { "retention_days": 400, "immutable": true }
}
// The Agent Control Standard is about making agents observable and
// interruptible: you cannot govern what you cannot see or stop.

5. Enforce Policy in CI, Not in a PDF

Security guidance that lives only in a wiki decays. Code sample 5 shows the CI enforcement that makes the list real: fail the build when any agent declares an unscoped or wildcard tool, and validate every policy file against the control map before it can merge. This is the same governance-as-code pattern that cloud teams adopted years ago, now applied to agents. When the OWASP list updates, your gate updates with it, because the gate reads the same file the list is mapped to. Treat the mapping as code you own, not a document you copy. When OWASP ships the next edition, your upgrade is a pull request, not a migration project.

# .github/workflows/agent-policy.yml — fail the build on unscoped agents
name: agent-policy
on: [pull_request]
jobs:
  policy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Every agent must declare scoped tools
        run: |
          npx owasp-agent-lint tools.yaml controls/llm-top10.yaml --fail-on critical
      - name: Block wildcard scopes
        run: '! grep -rE "scopes:\s*\[\s*\"\*\"" . --include=*.yaml'
# Mirrors the list to NIST, MITRE ATLAS and CWE so one policy
# satisfies several frameworks at once.

6. Where to Start This Week

If you only do three things, do these. First, map every agent risk to a named control and mark Excessive Agency critical. Second, put both-directions guardrails in front of every model and tool call. Third, put an explicit, deny-by-default tool allowlist in version control and fail CI on wildcards. That covers the ranking change OWASP highlighted, the most common attack path, and the governance layer the new Agent Control Standard exists to describe. The 2026 list is not longer than last year's. It is just far more specific about the failure that autonomy makes possible. None of this requires a new vendor. It requires writing down, in files, what you already believe about your agents, and then making the pipeline enforce it.