Quick Facts
- OWASP ranks prompt injection as the top vulnerability for LLM applications, but real-world incident records place it at No. 12.
- Attack success rates range from 50% to 84%, and 84% of agentic AI systems tested in 2026 fell to prompt injection exploits.
- Only 34.7% of organizations have deployed dedicated prompt injection defenses, even as the threat appears in 73% of production AI deployments assessed during security audits.
Prompt injection sits at the top of OWASP’s LLM risk list and near the bottom of the real-world incident record. Security experts say that contradiction is not a mistake. It is a warning.
The 2026 OWASP LLM Top 10 ranked prompt injection as LLM01, the most critical threat facing enterprise AI deployments. At the same time, when OWASP weighted 6,639 real incidents from public vulnerability databases at 25% of the final score, the attack ranked No. 12 in that dataset.
John Lambros, co-lead of the OWASP GenAI Security Project and director of AI standards and governance at Zenity, described the conflict in direct terms. “We had two ways of measuring the same risk, expert judgment and the public incident record, and they disagree with each other,” Lambros said. “Neither one is the truth. Two witnesses are contradicting each other, and we can’t tell you which one is lying.”
Why Scanners Miss It
Prompt injection targets how a model reasons, not how code executes. Traditional application security tools are built to identify unsafe execution paths, recognizable payloads, and observable failures. Prompt injection fits none of those patterns.
The attack hides instructions inside content a model reads, including log entries, support tickets, and documents retrieved during a session. The model then executes the attacker’s intended action using credentials it legitimately holds. No code defect is created, no CVE is generated, and no scanner flags the request.
There are two primary attack types. Direct injection manipulates a model through a user’s own input, either through deliberate crafting or unintentional triggers. Indirect injection embeds instructions inside third-party content the model consumes. An attacker might post crafted instructions on a public forum. When an AI assistant summarizes that forum later, it processes and follows the embedded command.
Indirect injection now accounts for more than 55% of observed attacks in 2026, according to research cited in the OWASP report. Indirect attacks carry 20% to 30% higher success rates because they arrive through trusted sources. In enterprise environments, 62% of successful exploits used indirect injection pathways.
The Defense Effect
OWASP researchers believe the low incident-record ranking reflects successful defense spending, not low actual risk. Organizations are blocking enough attacks to suppress public disclosures, which makes the recorded count appear small even as teams spend real money preventing a much larger volume of attempts.
Steve Wilson, co-chair of the OWASP GenAI Security Project and chief AI officer at Exabeam, noted the expanded data set behind the new rankings. “This update is grounded in much more than expert opinion. OWASP now has a database containing roughly 10,000 real-world AI security incidents, giving us a clearer picture of which risks are actually showing up as organizations deploy these systems,” Wilson said.
The Numbers Behind the Risk
Attack success rates range from 50% to 84% depending on system configuration, according to a 2025 study cited by Proofpoint. One dataset documented more than 461,640 prompt injection submissions. In 2026 testing, 84% of agentic AI systems fell to the attack, including Cursor IDE, which received a CVSS score of 9.8, GitHub Copilot at 9.6, and Microsoft Copilot at 9.3.
Google reported a 32% relative increase in malicious prompt injection activity between November 2025 and February 2026. The threat now appears in 73% of production AI deployments reviewed during security audits.
The confidence gap among executives is wide. A 2026 Beam AI survey found 82% of executives believed their existing policies protected them from unauthorized agent actions. A separate survey found 88% of organizations reported confirmed or suspected AI agent security incidents in the past year.
What This Means for AI Deployments
The Cisco State of AI Security 2026 report found 83% of organizations plan to deploy agentic AI, but only 29% feel prepared to do so securely. Only 34.7% of organizations have deployed dedicated prompt injection defenses.
Ivanti’s 2026 cybersecurity research found 77% of security teams report comfort letting AI agents act without human review. That approval rate exists while experts cannot reach statistical agreement between their risk rankings and the incident record.
For companies building or buying AI agents, the takeaway is direct. Conventional security tooling will not catch this class of attack. The absence of incidents in a public database is not evidence of safety.