Attacks against AI target the system itself, not your inbox. See the three OWASP lists covering the model, agent, and tool layers, and how they chain.
Attacks involving AI split into two categories: attacks carried out by AI, and attacks carried out against AI. The second is larger and less understood. Three OWASP lists now organise it, covering the model layer, the agent layer, and the tool-connection layer between them.
Most coverage blurs them, and the blur produces budgets that cover neither properly.
Attacks by AI are familiar attacks made faster and more convincing. Social engineering, vulnerability exploitation, and authentication attacks all get better when an attacker has generation and automation. The attack type does not change. Its yield does.
Attacks against AI are different in kind. Here the AI system is the target, and the techniques have no pre-AI equivalent. Poisoning a model’s memory is not a variant of anything defenders handled before 2023.
That distinction decides where money goes. Detecting AI-enhanced phishing does nothing to protect the agents in your own environment, and hardening those agents does nothing about AI-generated lures arriving in your inbox. Related ground appears in where AI is changing the threat picture.
Long unstructured lists of AI attack names are common and hard to use. Three published taxonomies now do the organising, and each covers a distinct layer.
| List | Published | Layer it covers |
|---|---|---|
| OWASP Top 10 for LLM Applications 2026 | 3 August 2026 | The model as a component inside an application |
| OWASP Top 10 for Agentic Applications 2026 | 9 December 2025, updated to v2.01 on 1 June 2026 | A system that plans, remembers, uses tools, and acts |
| OWASP MCP Top 10 | Beta, entries MCP01:2025 to MCP10:2025 | The tool-connection layer between an agent and external systems |
The division is clean. One list governs what a model says. Another governs what a system does. The third governs how it reaches the outside world.
They stack rather than compete. The agentic list extends the LLM list rather than replacing it. Each agentic entry cross-references its model-layer counterparts, so an assessment runs top to bottom instead of choosing between frameworks.
Discover how Threatcop protects your workforce from modern cyber threats.
The 2026 LLM list runs in this order, and the order reflects both practitioner voting and incident data.
| ID | Risk | What it means in plain terms |
|---|---|---|
| LLM01 | Prompt Injection | Untrusted text is read as instruction because data and commands share one context window |
| LLM02 | Sensitive Information Disclosure | The model reveals data it held, was trained on, or was given |
| LLM03 | Excessive Agency | The system can do more than its task requires, so a manipulation becomes an action |
| LLM04 | Supply Chain | Compromised models, packages, datasets, or plugins enter before deployment |
| LLM05 | Data and Model Poisoning | Training or fine-tuning data is corrupted to shape later behaviour |
| LLM06 | Unbounded Consumption | Resource exhaustion and runaway cost, the AI-era denial of service |
| LLM07 | Misinformation | Confident wrong output that downstream systems or people act on |
| LLM08 | Hidden Context Exposure | Context the user cannot see leaks or influences results |
| LLM09 | Vector and Embedding Weaknesses | Retrieval stores are manipulated, so the model retrieves attacker content |
| LLM10 | Improper Output Handling | Model output reaches a shell, database, or browser without validation |
Two entries reward a second look. LLM03 rose from sixth place in the 2025 edition, which tracks how much real authority AI systems gained in a year. And LLM10 is the oldest idea on the list wearing new clothes. Passing unvalidated output into an interpreter is an injection flaw defenders have handled for decades.
Once a model stops generating text and starts acting, new categories appear. The agentic list numbers its entries ASI01 to ASI10, and the following are the ones documented in published coverage.
Notably, ASI06 is the one that surprises people. A poisoned memory is not a single bad response. It is a bad instruction that persists, which makes it closer to a backdoor than to a prompt.
Treating a top ten as ten separate problems produces a plan that fails in the middle. Real incidents combine entries.
In practice the pattern is consistent. ASI01 and ASI06 are entry points, where an attacker gets their instruction into the system. ASI02 and ASI05 are where the attack cashes out, converting that instruction into an action with consequences.
Most real incidents pair one of each. Therefore, closing only the entry point, or only the impact, leaves the chain alive.
That has a practical implication for prioritisation. A team that spends everything on prompt injection filtering and nothing on tool scoping has hardened one end of a two-ended problem. Permission scoping details sit in governing what automation is allowed to do.
Prompt injection held the top LLM position again in 2026. The way it got there is more interesting than the result.
The two inputs to the ranking disagreed sharply. Practitioners voted it first. Incident data alone would have dropped it out of the top ten entirely.
OWASP attributes that low incident count to years of defensive investment rather than to a shrinking attack surface. The surface still sits everywhere a model reads untrusted input, which is everywhere.
So the ranking is a statement about attention rather than frequency. Read it as a warning that the defences suppressing those incident numbers are load-bearing, and that removing them returns the problem immediately.
Security teams often assume their application security stack extends to AI features. Largely, it does not.
Traditional static analysis and software composition analysis inspect code and dependencies. They cannot see an agent’s prompts, its tools, its memory, or the traffic between agents. Those live in a layer the tooling was never built to examine.
The consequence is a visibility gap that looks like coverage. A clean SAST report on a repository says nothing about whether the agent that repository deploys holds a standing credential to a production database.
Closing it needs runtime observability rather than more scanning: what the agent did, why it did it, and under whose identity. Visibility problems of this shape appear in why security tooling misses the agent layer.
The agentic list is deliberately incident-driven, with nearly every entry anchored to a public 2025 or 2026 event. Three make the categories concrete.
EchoLeak, tracked as CVE-2025-32711, demonstrated zero-click data exfiltration, meaning the victim did not have to interact for data to leave.
The Amazon Q compromise weaponised a coding assistant with more than 950,000 installs, turning a trusted developer tool into a distribution channel.
And Replit’s agent deleted a production database during a code freeze, which is the clearest illustration available that agent risk is about authority rather than intelligence.
That grounding is what makes the list usable as an audit checklist rather than an awareness poster.
Underneath the taxonomy sit two ideas, and holding them is more useful than memorising twenty identifiers.
Least agency is the first. It limits not only what an agent can access, but how much it can do without checking back with a human. Access scoping alone is insufficient once a system can chain many steps together.
Strong observability is the second. Seeing what an agent did, why, and under whose identity is what turns an incident into something investigable.
Importantly, neither requires a product. Both require decisions about authority and logging that most teams have not yet made, which is why the gap persists even in organisations with mature application security.
Nothing in the taxonomy is purely technical, because somebody grants each permission the attacks exploit.
An employee approves an OAuth scope during setup. A developer connects an agent to a database because the task needed it that afternoon. Someone installs a marketplace component without reading what it does. Each is a security decision made by a person who may not know they made one.
Threatcop’s TLMS delivers role-specific content for exactly those moments, so developers wiring agents and staff approving connections get different scenarios rather than a shared AI module. Programme design for that sits in training built around what each team does.
Take a single AI system running in your environment. Identify its entry points, meaning everywhere it reads content somebody else controls. Then identify its cash-out points, meaning every tool it can call and every credential it holds.
Most teams find the two lists are maintained by different people who have never compared them. That gap is the chain the taxonomy describes, and closing it does not need a new product.
Then look at who granted the permissions on the second list, and make sure those people understand what they approved before the next integration ships.
Three OWASP taxonomies organise them. The Top 10 for LLM Applications 2026 covers the model layer. Its entries are prompt injection, sensitive information disclosure, excessive agency, supply chain, data and model poisoning, unbounded consumption, misinformation, hidden context exposure, vector and embedding weaknesses, and improper output handling. The Agentic Top 10 covers risks appearing once a system acts. The MCP Top 10 covers the tool-connection layer.
Attacks by AI are conventional techniques made faster and more convincing through generation and automation, such as AI-written phishing or automated vulnerability discovery. Attacks against AI target the AI system itself through techniques with no pre-AI equivalent, including prompt injection, memory poisoning, and agent goal hijacking. They need separate controls and separate budgets.
Agent goal hijacking is ASI01 in the OWASP Top 10 for Agentic Applications. An adversary redirects the agent’s objective or decision path using content the agent reads. The agent then pursues the attacker’s goal while appearing to operate normally, which is harder to spot than an obvious malfunction.
Not adequately. Static analysis and software composition analysis inspect code and dependencies, but cannot see an agent’s prompts, tools, memory, or inter-agent traffic. Agentic attacks occur in a layer most application security tooling never inspects. A clean scan report can therefore coexist with an agent holding standing credentials to production.
Prompt injection remains LLM01 in the 2026 edition, though the ranking inputs disagreed. Practitioners voted it first, while incident data alone would have placed it outside the top ten. OWASP attributes the low incident count to sustained defensive investment rather than a shrinking attack surface, which still exists wherever a model reads untrusted input.
Sushant Kumar is the AVP – Technology at Threatcop, bringing over a decade of experience in technology leadership and product development. He has worked across technology-driven organizations, including Paytm, and focuses on building scalable solutions that address evolving business and cybersecurity challenges. His areas of interest include cybersecurity technology, AI-driven security, product innovation, and enterprise technology. He is passionate about using technology to solve complex security challenges.
AI-to-AI communication already runs on MCP and A2A, and neither mandates an audit trail. See how each fails, and...
Continuous compliance readiness means evidence accumulates as controls operate. See what assessors ask for, the parameter trap, and a...
AI phishing prevention starts with a correction: AI authorship cannot be measured reliably. See which recognition signals died, which...