The Three Changes That Matter for ANZ SaaS Teams
The first is Excessive Agency at number three.
The 2025 list treated agency as a downstream concern. The 2026 list treats it as the control deciding whether an injection is an inconvenience or an incident. Excessive Agency is what happens when an AI system can act, not just answer, and holds more permission than its task requires.
The practical version of this for an ANZ SaaS product: an AI assistant that can read documents, send emails, create tickets, or call internal APIs is an agent. If it holds the permissions to take those actions without a human checkpoint, a successful prompt injection becomes a live action rather than a wrong answer.
Prompt injection stayed at number one despite falling out of the top ten on raw incident counts. The project leads attribute this to a defence effect: teams fight it hard enough that fewer clean exploits reach a public database. The fact that it held position despite fewer confirmed incidents means the community believes it remains the root cause of most LLM compromises, even when the downstream incident looks like something else.
The second is the expanded scope of Prompt Injection at number one.
The 2026 entry widens the scope of Prompt Injection to cover cross-modal attacks, where the payload hides in an image, an audio file, or a video frame. For ANZ SaaS platforms that process user-uploaded documents, images, or media files through an AI pipeline, this is a material scope expansion. A malicious instruction embedded in an uploaded PDF, a support ticket image, or a product photo now falls within the Prompt Injection definition. Testing for prompt injection in 2026 means testing every content type that enters the AI pipeline, not only text input fields.
For how API security testing connects to the LLM injection surface in AI-powered applications, the guide to API penetration testing covers what a well-scoped API assessment examines across input paths, including content-type injection vectors that LLM testing must also address.
The cross-modal expansion also has a specific implication for ANZ healthtech platforms processing clinical documents or radiology images through AI diagnostic tools, and for ANZ fintech platforms processing identity documents or financial statements. Both are content pipelines. Both are now in scope for OWASP LLM01 testing in 2026 in a way they were not in 2025.
When Your AI Assistant Has Tool Access, Prompt Injection Becomes Live Action
Find out whether your LLM deployments, RAG pipelines, and agentic workflows can be tricked into unauthorised data exposure or arbitrary tool execution.
What This Means for Testing in 2026
The LLM Top 10 2026 test for Prompt Injection requires placing conflicting instructions in every user-controlled text path and retrieved document path, verifying they cannot override higher-priority rules or trigger unauthorised actions. For Excessive Agency, testing covers overprivileged tools, approval bypass, unsafe autonomous actions, and excessive API permissions.
Read Both Lists Together: Component vs Actor
The OWASP LLM Top 10 and the OWASP Top 10 for Agentic Applications are meant to be read together. The LLM list covers the model as a component. The Agentic Top 10 covers the model as an actor with tools, memory, and downstream consequences. For ANZ SaaS teams deploying AI agents, both frameworks apply.
A CREST-accredited AI penetration test maps findings to the OWASP LLM Top 10 2026 and the Agentic Top 10, confirming whether each risk category is addressed in the specific deployment context. The guide to autonomous pentesting and what actually works covers how manual testing and AI-assisted scanning combine to validate LLM-specific risks that automated tools alone cannot confirm.
Book a scoping consultation with Capture The Bug to confirm the AI penetration testing scope your LLM feature, AI agent, or RAG deployment needs against the 2026 OWASP LLM Top 10.
Frequently Asked Questions
What changed in the OWASP LLM Top 10 2026?
The OWASP LLM Top 10 2026 was published on August 4, 2026. Eight of ten entries changed position. Excessive Agency rose from sixth to third, the biggest single move on the list. Unbounded Consumption rose from tenth to sixth. Improper Output Handling fell from fifth to tenth. System Prompt Leakage was renamed and re-scoped as Hidden Context Exposure, now covering all non-user-visible context including RAG schemas and retrieved documents. Prompt Injection and Sensitive Information Disclosure held their positions at first and second. The 2026 edition was checked against real incident data rather than practitioner voting alone.
What is Excessive Agency in AI security and why did it move to number three in 2026?
Excessive Agency describes an AI system that holds more permissions, functionality, or autonomy than its task requires. The 2026 list moved it from sixth to third because agentic AI deployments made the risk concrete. When an LLM can take real actions (send emails, create tickets, call APIs, execute code) and holds the permissions to do so without a human approval checkpoint, a successful prompt injection becomes a live action rather than a wrong answer. The 2026 list treats Excessive Agency as the control that determines whether an injection is an inconvenience or an incident.
What is Hidden Context Exposure in the OWASP LLM Top 10 2026?
Hidden Context Exposure (LLM08:2026) is the renamed and re-scoped version of System Prompt Leakage from the 2025 list. The 2026 scope expands beyond the system prompt to cover all non-user-visible context: RAG schemas, retrieved documents, and hidden policy logic. For SaaS products using retrieval-augmented generation to pull internal documentation, customer data, or policy content into AI responses, the attack surface is now the retrieval pipeline itself. An attacker who can extract RAG schemas or retrieved documents accesses content that was never meant to surface in the chat interface.
What does cross-modal Prompt Injection mean in the 2026 OWASP list?
The 2026 OWASP LLM Top 10 expanded Prompt Injection (LLM01:2026) to explicitly cover cross-modal attacks, where a malicious instruction is embedded in an image, audio file, or video frame rather than in text. For ANZ SaaS platforms that process user-uploaded documents, images, or media through an AI pipeline, this means testing for prompt injection must cover every content type that enters the AI pipeline, not only text input fields. A malicious instruction embedded in an uploaded PDF, a support ticket screenshot, or a product image now falls within the OWASP Prompt Injection definition.
Do ANZ SaaS teams need to test against both the OWASP LLM Top 10 and the OWASP Agentic Top 10?
Yes, if the product deploys AI agents. The OWASP LLM Top 10 covers the model as a component: the risks within the model itself and its immediate input and output handling. The OWASP Top 10 for Agentic Applications (published December 2025, updated June 2026) covers the model as an actor with tools, memory between sessions, and downstream consequences. For ANZ SaaS teams with AI assistants that can take actions (file operations, API calls, email, ticket creation), both frameworks apply and both require specific testing approaches. CREST-accredited AI penetration testing maps findings to both frameworks.
