Agent security: the threat list is now evidence, not theory

The most useful thing about the latest edition of OWASP’s agentic AI security guidance is a change in evidence base. The 2025 edition catalogued threats that were plausible. The 2026 edition replaces much of that with disclosed CVEs, vendor advisories and breach reports — things that actually happened.

Prompt injection still ranks as the leading vulnerability, and it now maps onto six of the ten categories in the agentic top ten. It is not one risk among many; it is the mechanism behind most of the others.

Why it stays unsolved

This is the part worth understanding, because it explains why the problem has not gone away despite two years of attention. A language model processes everything it receives as a single sequence of tokens. There is no reliable way to enforce a privilege boundary between the system prompt, the user’s question, and content the model retrieved from somewhere else.

Everything the model reads carries the same authority. A web page an agent fetches can contain text that reads as an instruction, and the model has no structural means of ranking your instruction above the page’s. Filters help at the margins. They do not change the architecture.

Treat this as a design constraint, not a bug awaiting a patch. Systems that assume prompt injection will be fixed are building on something that has not happened and may not.

What the guidance actually recommends

Defence in depth, on the assumption that injection will sometimes succeed:

• Least-privilege tooling. An agent should hold the narrowest set of permissions that lets it do its job. Most damage comes from over-broad tool access, not from clever prompts.
• Human approval for high-risk actions. Anything irreversible or outward-facing — sending, publishing, paying, deleting — gets a person in the loop.
• Input and output filtering. Imperfect, still worth having.
• Regular adversarial testing. Treat agents like any other attack surface and test them as one.

If you’re deploying agents at work

The practical checklist is short. Know what each agent can reach, because data-loss controls only work if they cover the paths agents actually use. Know which agents exist, because unsanctioned tools are where this goes wrong quietly. And be honest about which actions you would not want taken on the strength of a web page the agent happened to read.