Agent security: the threat list is now evidence, not theory

This is an archived snapshot from July 2026. For the current picture, see September’s agent security edition.

The most useful thing about the latest edition of OWASP’s agentic AI security guidance is a change in evidence base. The 2025 edition catalogued threats that were plausible. The 2026 edition replaces much of that with disclosed CVEs, vendor advisories and breach reports. Things that actually happened.

Prompt injection still ranks as the leading vulnerability, and it now maps onto six of the ten categories in the agentic top ten. It is not one risk among many; it is the mechanism behind most of the others.

Why it stays unsolved

This is the part worth understanding, because it explains why the problem has not gone away despite two years of attention. A language model processes everything it receives as a single sequence of tokens. There is no reliable way to enforce a privilege boundary between the system prompt, the user’s question, and content the model retrieved from somewhere else.

Everything the model reads carries the same authority. A web page an agent fetches can contain text that reads as an instruction, and the model has no structural means of ranking your instruction above the page’s. Filters help at the margins. They do not change the architecture.

Treat this as a design constraint, not a bug awaiting a patch. Systems that assume prompt injection will be fixed are building on something that has not happened and may not.

What the guidance actually recommends

Defence in depth, on the assumption that injection will sometimes succeed. Start with least-privilege tooling: an agent should hold the narrowest set of permissions that lets it do its job, because most damage comes from over-broad tool access rather than clever prompts. Put human approval in front of high-risk actions, meaning anything irreversible or outward-facing, like sending, publishing, paying, or deleting. Input and output filtering is imperfect and still worth having. And test your agents adversarially on a schedule, the way you would any other attack surface.

If you’re deploying agents at work

The practical checklist is short. Know what each agent can reach, because data-loss controls only work if they cover the paths agents actually use. Know which agents exist, because unsanctioned tools are where this goes wrong quietly. And be honest about which actions you would not want taken on the strength of a web page the agent happened to read.