Prompt injection ranks No. 1 with OWASP and No. 12 in the incident record. The attack itself is invisible to a scan.

A new analysis of real-world attack records suggests the widely cited ranking of large language model security risks may not match what is actually happening in the field, complicating how US security teams decide where to focus their defenses. The analysis, published on arXiv on August 18 by Kyriakos “Rock” Lambros and Steve Wilson, two leaders of the OWASP Top 10 for LLM Applications project, compared the expert-voted list against 6,639 labeled incidents from public databases. While prompt injection has held the No. 1 spot on the OWASP list for three consecutive years, it ranked only No. 12 in the incident data, a gap the authors attribute to the attack’s invisibility to conventional vulnerability scanners rather than a reduction in danger.

The study drew on 7,714 LLM security incidents from CVE, GitHub Security Advisories, OSV, and the AIAAIC database, applying a Bayesian model to correct for classifier errors. The statistical comparison found no significant agreement between the expert rankings and the incident record, with a Cohen’s kappa score of 0.20 and an interval that crossed zero, meaning the two lists could align purely by chance. Lambros described the situation in evidentiary terms, saying the two measurement methods contradict each other and that neither can be treated as the truth.

The structural reason for the divergence is that prompt injection hides instructions inside content a model reads, such as log entries or documents, and the agent then makes tool calls using credentials it legitimately holds, leaving no product defect or CVE for a scanner to find. Defenses therefore rely on adversarial testing and hard limits on what an agent can access, rather than on patching known flaws. Wilson, chief AI and product officer at Exabeam, said his first control would be an authorization gate outside the model, preventing an agent from granting itself authority even if it proposes a change, a tradeoff that limits autonomous improvisation but preserves routine remediation.

The analysis also found misinformation ranked No. 2 in the incident record but only No. 13 in the expert vote, the widest disagreement between the two lists, though the authors noted the corpus includes many records describing harm from AI rather than a vulnerability inside an LLM. Incident data is inherently backward-looking, Wilson noted, and tells security teams what was observed and reported, not necessarily what is most dangerous in systems being built now. He compared prompt injection to a law of physics for LLM systems, arguing that a control working 99 percent of the time is insufficient when the failure case gives an attacker meaningful access.

CrowdStrike’s 2026 Global Threat Report documented adversaries injecting malicious prompts into legitimate GenAI tools at more than 90 organizations in 2025, stealing credentials and cryptocurrency, a finding the paper cites as evidence of sustained attack pressure. Public CVEs also include an Azure Data Explorer MCP Server entry describing KQL injection scored 8.3 High, and a Kong Konnect MCP Server indirect prompt injection, along with a critical-rated flaw in the Ruflo agent harness that exposed MCP bridge endpoints. Lambros argued that poisoned agent memory does not announce itself, resembling a procurement agent repeatedly approving invoices under a threshold, and that a zero incident count measures blindness rather than safety, making early investment in memory and tool boundaries a cost-effective timing decision for US enterprises.

More cybersecurity news from TechManNews.