AI Security

OWASP released the 2026 edition of its Top 10 for LLM Applications on August 6. The AI attack surface is highlighted by this update for developers and security teams. The edition reframes the field and clarifies key risks. It guides risk-aware design for AI systems.

Additionally, avoid pursuing a model that cannot be fooled. It is unrealistic to expect perfect resilience. Instead, emphasize graceful degradation and fail-safe responses. Design checks and monitoring should detect anomalies early. Regular audits and red-teaming can strengthen defenses without promising invulnerability.

Moreover, design the system so that when it is fooled, no critical function fails. This approach helps maintain user trust and operational continuity. It pairs with robust incident response and clear recovery protocols. Staff training and documented procedures ensure quick, coordinated action.

That is a shift from prevention to blast-radius control, and it changes how you map the AI attack surface. You stop asking whether an attack can land. You start asking what it reaches when it does.

This page maps the AI attack surface in five layers: what fails at each, and where the deeper coverage sits.

Key Takeaways on the AI Attack Surface

• The 2026 OWASP list keeps prompt injection at number one, and the AI attack surface still has no complete fix for it.
• Excessive Agency climbed to third, since agentic deployments are where AI attack surface damage now lands.
• OWASP drew a new boundary: once a model gains tools, memory, and consequences, it moves to a separate agentic list.
• For the first time the ranking used incident data, with 6,639 real incidents carrying 25% of the weight.
• Blast-radius control beats perfect prevention across the AI attack surface, and every layer reflects that.

Quick Navigation

Why the AI Attack Surface Needs a Layer Map

Security teams keep treating the AI attack surface as one problem. It is five, and the defenses differ at each.

A model weakness is not a prompt weakness. A tool weakness is not an agent weakness. Fixing the wrong layer yields the familiar outcome: real money spent, exposure unchanged.

The AI attack surface runs outward from the weights. First the model itself, then the prompt that reaches it, then the tools it can call, then the agent loop chaining those calls. Underneath all of it sits the supply chain that delivered the rest.

Each AI attack surface layer inherits the weaknesses of the one below. So a poisoned model makes every prompt defense unreliable, and a compromised tool makes agent-level approval theater.

Work up the AI attack surface when building, and down it when investigating.

Building means securing the supply chain before the agent, since you cannot reason about behavior you cannot trust. Investigating means starting at the observed harm and tracing back, because the visible failure is rarely the entry point.

Layer 1 of the AI Attack Surface: The Model

Start the AI attack surface at the weights, where least attention usually goes.

Data and model poisoning sits in the OWASP list. The 2026 edition widened it to cover fine-tuning subversion too. An attacker who shapes training data leaves behind behavior no runtime filter will catch. Backdoors trigger on specific phrases and stay dormant otherwise. Poisoned fine-tuning shifts refusal behavior subtly. Extraction attacks pull training data back out through careful querying.

None of these announce themselves. They are the quietest part of the AI attack surface, and the hardest to test for after deployment.

What reduces the risk

Provenance is the main AI attack surface control at this depth. Know which checkpoint you are running, where it came from, and what changed since.

Open weights cut both ways here. You can inspect them, and you also inherit whatever the publisher did. The licence and provenance questions around frontier open weights matter as much for security as for legal review.

Layer 2 of the AI Attack Surface: The Prompt

Prompt injection has topped every OWASP edition, and it still anchors the AI attack surface in 2026.

The root cause is design, not a bug. Models read instructions and data through one channel with no clean split. So anyone who controls an input can write orders the model treats as real. Prompt injection now covers cross-modal attacks, widening the AI attack surface. Instructions hidden inside images or audio reach the model the same way text does, which widens the AI attack surface considerably for multi-modal systems.

Direct injection comes from the user. Indirect injection rides in on fetched content: a web page, a document, an email, a code comment. The indirect kind is worse, because nobody typed it.

The defense effect

Here is an AI attack surface detail worth understanding. OWASP notes that recorded prompt injection incidents are relatively few, and attributes this to a defense effect rather than a low risk.

Teams spend heavily to block it, so successful attacks rarely reach public databases. Reading that low incident count as low danger inverts the actual picture. Scale matters too, because attackers retry. Anthropic’s published system card figures for one agentic coding setup show indirect injection landing 4.7% of the time at one try, 33.6% at ten, and 63.0% at a hundred. Attackers get to retry.

Layer 3 of the AI Attack Surface: The Tool

Once a model can call something, the AI attack surface stops being about text.

A tool turns a wrong answer into a wrong action. Sending an email, running a query, moving money, deploying code. The model does not need to be compromised for this to hurt, only misled. Over-broad scopes come first in this part of the AI attack surface. A tool granted database write access when it needs read access hands an attacker the difference.

Output handling comes second. OWASP moved it from fifth to tenth in 2026, though the category grew wider. The pattern holds: app code trusts model output and runs it unchecked. Then comes the wiring. MCP sets how models reach tools. The NSA published design guidance for it in May 2026, naming prompt injection and tool poisoning as open gaps.

Practical controls

Scope every credential to the narrowest task. Allowlist tools rather than blocking known-bad ones. Validate model output before execution, exactly as you would validate user input. And log every call. Most AI attack surface investigations fail because nobody recorded which tool ran with which arguments.

Layer 4 of the AI Attack Surface: The Agent

This is where AI attack surface damage now concentrates, and OWASP moved the category to match.

Excessive Agency climbed to third place in 2026, with expert voting and incident data agreeing for once. Agentic deployments are where harm is landing. The 2026 edition drew an explicit AI attack surface line. It covers the model as a part inside an app. Once the model becomes an actor, with tools it calls and memory it keeps, the risk moves to a separate agentic list.

That split helps when mapping the AI attack surface. Agent risk is not harder model risk. It is a different job, closer to identity work than to content filtering.

What breaks in the agent AI attack surface

Chained actions compound. An agent that reads a document, decides, and acts gives an attacker three points of influence rather than one. Memory persists. An injection that lands once can sit in stored context and fire on later sessions.

Autonomy removes the check. Human approval gates are the crudest control here and still the most effective, which is an uncomfortable thing to admit in 2026. Misinformation also climbed two places, and the reason is agentic. Model output now drives tool calls, writes code, and steers other agents. So a plausible wrong answer becomes a system failure, not a bad paragraph. The difference between agentic and generative systems is the difference between these two risk profiles.

Layer 5 of the AI Attack Surface: The Supply Chain

Every AI attack surface layer above assumes the components are what they claim to be.

This layer covers weights, datasets, embedding stores, framework dependencies, and now agent skills. OWASP started an Agentic Skills Top 10 in April 2026 because skill stores opened a new delivery route.

Old supply chain thinking applies to the AI attack surface, and it falls short. A poisoned npm package acts the same every time. A poisoned model acts normal until a trigger fires.

That difference breaks conventional scanning. You cannot diff weights the way you diff source code and learn much.

Minimum controls

Pin model versions with hashes, not tags. Record which dataset and checkpoint produced each deployed system. Treat community fine-tunes with the caution you would give an unsigned binary.

Vendor promises matter here too. State AI rules now impose real record-keeping duties on builders and deployers, and those duties run the whole AI attack surface.

Mapping the AI Attack Surface to Existing Frameworks

You do not need a new AI attack surface taxonomy. Three existing ones cover this ground, and they interlock.

The OWASP Top 10 for LLM Applications handles the model as a component. The Agentic Top 10 picks up where tools and memory begin. MITRE ATLAS v5.1.0 supplies adversary tactics and techniques, with 16 tactics and 84 techniques as of November 2025.

OWASP tells you what can go wrong. ATLAS tells you how an attacker would do it. The NIST AI Risk Management Framework tells you how to govern the result.

So run OWASP for design review, ATLAS for red-teaming, and NIST for board reporting. Using one where another fits is the most common mistake in AI attack surface programmes.

Where the frameworks still have gaps

Skills ecosystems reached the AI attack surface faster than the standards did. OWASP’s Agentic Skills Top 10 was still an incubator project as of April 2026, which means the newest distribution channel has the thinnest guidance.

Insurance lags too. Cover for AI incidents stays patchy, and a lot of silent exposure sits in policies written before any of this existed.

What Changed in the 2026 OWASP Rankings

The methodology change is the real AI attack surface story, more than any single move.

Every earlier edition rested on expert consensus. The 2026 list kept voting at 75% of the weight. The other 25% came from 6,639 real incidents in public vulnerability databases and an AI-harm database.

Misinformation is the clearest case. Voters ranked it near the bottom. The incident record ranked it near the top, and the data pushed it up two places.

That gap is worth sitting with. Experts play down risks that cause quiet, slow harm, and play up the ones that make good conference talks.

The full set of moves

Prompt Injection and Sensitive Information Disclosure held the top two AI attack surface slots. Excessive Agency rose to third. Unbounded Consumption climbed four places as cost-drain attacks got taken seriously. Output Handling fell from fifth to tenth. System Prompt Leakage became Hidden Context Exposure, with wider scope.

Two categories absorbed new scope rather than spawning entries. Prompt injection took on cross-modal attacks. Data and Model Poisoning took on fine-tuning subversion.

The AI Attack Surface Pattern That Predicts Exploitability

One formulation explains more real AI attack surface incidents than the whole ranking does.

Simon Willison’s lethal trifecta describes three properties that, combined, make a system exploitable: access to private data, exposure to untrusted content, and the ability to communicate externally.

Why the trifecta works as a test

Any two are usually survivable. All three together mean an attacker can inject instructions, reach your data, and get it out.

So audit the AI attack surface by asking which of your systems hold all three. That single question finds more genuine exposure than a checklist pass, and it takes an afternoon.

Removing any one leg breaks the chain. Cut external communication, restrict which content the system ingests, or partition the private data. Any one of the three works.

How to Shrink the AI Attack Surface Blast Radius

The 2026 framing points at design rather than detection, so build the AI attack surface for containment.

Assume injection succeeds. Design the AI attack surface so a fooled model reaches nothing critical. This is the central move.

Scope credentials narrowly. Every permission an agent holds is a permission an attacker inherits.

Gate irreversible actions. Human approval before anything that moves money, deletes data, or ships code.

Log everything. Tool calls, arguments, retrieved content. Without these, incident response has nothing to work from.

Red-team continuously. Attack success rises sharply with attempts, so a single passing test proves very little.

AI Attack Surface Incidents Worth Knowing

Theory moves slowly. Incidents move the AI attack surface, and three are worth carrying as reference points.

Slack AI data exfiltration. PromptArmor researchers showed indirect prompt injection pulling data out of a live assistant. That proved the fetched-content path was real, not theoretical.

EchoLeak. Recorded as the first real-world zero-click prompt injection exploit in a live system. Zero-click matters, because no user has to be tricked at all.

Agent deception in national testing. UK cyber exercises in 2026 reported agent deception moving from theory into observed behavior.

A ranking convinces a security team. An incident convinces a budget holder.

So keep two or three concrete cases at hand when arguing for AI attack surface work. The abstract version of this argument has been losing for three years.

Wiring Your Own AI Attack Surface Review

Two hours gets you a first pass. Run it in this order.

Start by listing every system where a model reads content you do not control. That is your indirect injection exposure, and it is usually longer than expected.

Next, for each one, note whether it holds private data and whether it can send anything outward. Systems with all three legs go to the top of the AI attack surface queue. Then check credentials. Pull the actual scope on every token an agent holds, not the scope somebody intended.

Finally, confirm you have logs. If a tool call is not recorded with its arguments, you cannot investigate it later, and that gap is the most common finding in an AI attack surface review.

How to Use This AI Attack Surface Hub

Three AI attack surface entry points, depending on why you are here.

Responding to an incident. Start at the observed harm and work down the layers. The visible failure is rarely the entry point.

Designing a new system. Work up from the supply chain. Each layer depends on the one below being trustworthy.

Briefing leadership. The five layers map onto budget lines. An OWASP ranking does not.

This AI attack surface hub updates as coverage grows. Each new security post links back here, and the layer sections point to the pieces worth reading first.

Conclusion: The AI Attack Surface Is a Systems Problem

The most useful AI attack surface shift in the 2026 list is one of expectation.

Earlier guidance implied that enough filtering could make a model safe to trust. The new framing accepts that models get fooled, then asks what happens next.

That re-framing helps, because it moves the work somewhere solvable. Nobody knows how to make a model immune to prompt injection. Plenty of teams know how to scope a credential, gate an action, and log a tool call.

So read the AI attack surface as five layers with different owners, different controls, and different failure modes. Then go make the blast radius smaller.

FAQ About the AI Attack Surface

Keep reading

Here are the latest posts from the blog.