OWASP Top 10 for LLM Apps 2026: Excessive agency risk on the rise

The OWASP Top 10 for LLM Applications 2026 draft is out, and the biggest mover is Excessive Agency jumping to #2. This tracks directly with recent incidents where LLM agents, given too much autonomy, performed actions outside their intended scope—like deleting databases or modifying production configs.

Technical Breakdown:

• The Shift: Prompt Injection dropped to #3, while Excessive Agency (LLM01) moved up. This reflects a maturing threat model: we’re past worrying about just the model output, and now focused on the permissions we give the model.
• Root Cause: The risk isn't the LLM being "evil"—it's the application granting the LLM access to plugins, APIs, or databases with overly broad scopes (e.g., a customer support bot with DELETE permissions on the user DB).
• Attack Vector: An attacker doesn't need to jailbreak the model. They can simply craft a prompt that asks the agent to perform a legitimate-looking action that triggers a destructive function call (e.g., "Close my account and delete all associated records").
• Mitigation: Strictly enforce the Principle of Least Privilege on the agent's function calls. Implement human-in-the-loop approval for any destructive or high-impact actions. Treat the LLM agent as an untrusted user, not a trusted admin.

Defense: Audit your agent’s function call permissions. If your LLM can write to a database, ensure it can only write to specific rows/columns, and never execute DROP TABLE. Log all agent actions for forensic review.

Source: https://www.reversinglabs.com/blog/owasp-top-10-for-llm-apps-excessive-agency