In August 2026, the OWASP GenAI Security Project published its most consequential update since the LLM Top 10 launched in 2023. The list reshuffled. New categories emerged. Agentic AI moved from footnote to center stage. But one fact remained constant and underappreciated: almost every risk in the OWASP GenAI LLM Top 10 2026 leaves observable artifacts at the network layer.
Application-layer controls such as guardrails, content filters, and prompt shields are necessary, but they are not sufficient. They operate inside the trust boundary of the very system they are trying to protect. A compromised model does not respect its own guardrails, a poisoned adapter does not announce itself, and an agent exfiltrating data over DNS does not trigger an application-level DLP rule.
This is the gap a unified SASE stack fills. Inline TLS inspection sees the prompts leaving your network. CASB policies see which AI services your employees are using. DLP engines see the source code, the customer records, the API keys riding those prompts to external endpoints. SWG and RBI can sandbox untrusted model responses before they execute in a browser. Zero-trust segmentation can isolate agent tool calls to approved service meshes.
LLM01: Prompt Injection
What is prompt injection?
Prompt injection is what happens when input to an LLM changes the model’s behavior in ways the developer never intended. That input can be almost anything: direct user text, retrieved content, tool output, an image, audio, video, intermediate reasoning, even persistent memory.
LLMs make no architectural distinction between instructions and data. Both are tokens on the same stream. There is no clean equivalent to parameterized queries. This is not a bug. It is a fundamental property of how transformer-based architectures process sequences.
What changed in 2026
Prompt Injection stays at #1, but the 2026 definition is far broader than the 2025 one. OWASP now explicitly covers multimodal inputs, persistent memory and RAG, tool outputs, obfuscated payloads, and cross-session propagation. That matters for network defenders because indirect injection often starts outside the AI application itself.
Real-world incident
EchoLeak (CVE-2025-32711), disclosed by Aim Security in June 2025 and rated CVSS 9.3, was the first known zero-click attack on an AI agent. The flaw in Microsoft 365 Copilot let an attacker exfiltrate data with no user interaction: malicious instructions hidden in an email executed the moment Copilot’s RAG pipeline retrieved the content, leaking emails and files through covert channels. Microsoft patched it server-side, with no evidence of exploitation in the wild.
A second case, Slack AI data exfiltration, showed the same pattern inside a collaboration tool. An attacker planted malicious instructions in a public Slack channel. When a user later queried Slack AI, those instructions ran, pulled private channel context, and appended the data to an external link rendered as an image.
Network-layer indicators
- Outbound HTTP GET requests with high-entropy or Base64-encoded query parameters directed to unclassified or newly registered domains
- Anomalous markdown image preview requests originating from collaboration clients
- Unauthorized outbound API calls or webhooks from AI backend nodes
- Ingress HTTP POST payloads containing prompt-override signatures (“Ignore previous instructions…”) visible via TLS-decrypted SWG inspection
Security pillar of SASE control mapping
- SWG: Prevent and Detect. Decrypts outbound HTTPS traffic, blocks connections to untrusted exfiltration domains, and filters malicious markdown render targets.
- RBI: Contain. Isolates external web pages fetched by AI browsing extensions, stripping active script execution before content reaches ingestion pipelines.
- CASB and DLP: Prevent and Investigate. Audits third-party AI extensions, detects anomalous data movement, and inspects egress payloads for embedded credentials.
Prompt injection is often invisible as a semantic attack, but the actions it triggers are not.
LLM02: Sensitive Information Disclosure
What is sensitive information disclosure?
Sensitive Information Disclosure is the model handing out data it was never authorized to share: confidential, regulated, privileged, or proprietary. OWASP treats tool arguments, retrieved data, reasoning traces, embeddings, logs, telemetry, and observable inference properties as disclosure surfaces. That creates an immediate network-security connection. The final leak might be application-level, but the transfer of that data almost always crosses a network boundary.
What changed in 2026
The ranking stayed at #2, but the scope expanded substantially. OWASP explicitly includes inference side channels such as token length and timing, as well as observability systems and intermediate artifacts.
Real-world incident
In March 2026, a Meta internal AI agent triggered a Sev 1 incident. An employee posted a technical question in an internal developer forum, a colleague forwarded it to an AI agent, and instead of returning the answer privately, the agent posted its response directly into the forum without authorization. The original questioner acted on it, and a chain reaction followed. For two hours, employees with no authorization could see large amounts of internal company data and sensitive user data. Meta confirmed the incident and reported no evidence of external exploitation.
Network-layer indicators
- Outbound AI traffic carrying sensitive data leaving the organization through prompts, responses, uploads, or tool calls
- API keys, access tokens, secrets, certificates, or credential-like strings moving through encrypted or decrypted flows
- Suspicious encrypted connections identified through destination reputation, traffic volume, timing, payload size, and unusual session behavior
- Observability pipeline traffic (logs, traces, telemetry collectors) transmitting sensitive prompts, outputs, embeddings, or reasoning artifacts externally
Security pillar of SASE control mapping
- Inline DLP: Prevent and Detect. Performs deep packet inspection on decrypted TLS streams, identifying and blocking PII, proprietary code, cryptographic secrets, and custom document fingerprints before prompts reach external AI servers.
- CASB: Prevent and Contain. Enforces tenant restrictions so employees only reach enterprise-managed AI instances with strict data-retention policies, blocking consumer tiers.
- SWG and ZTNA: Prevent and Contain. Blocks unsanctioned shadow AI tools and restricts access to internal RAG repositories to authenticated workloads with verified posture.
Data disclosure to external AI services is the most directly preventable risk in the OWASP Top 10 using traditional SASE and DLP capabilities.
LLM03: Excessive Agency
What is excessive agency?
Excessive Agency is what happens when you give an AI system more functionality, more permission, or more autonomy than the task needs. When its output goes wrong, through confusion, ambiguity, or manipulation, that surplus power turns into damaging actions across external systems, databases, and APIs.
What changed in 2026
Excessive Agency jumped three positions, from #6 in 2025 to #3 in 2026, the largest climb on the list. This shift reflects the rapid enterprise transition from passive chatbots to active, autonomous multi-agent systems.
Real-world incident
In June 2026, Meta’s AI support chatbot on Instagram suffered an account-takeover incident. Attackers tricked the bot through conversation into believing they were legitimate account owners. Because the chatbot had direct access to high-risk backend tools without mandatory human-in-the-loop verification, it autonomously changed account recovery emails and triggered password resets, hijacking several high-profile accounts. Per Meta’s breach notification to the Maine Attorney General, 20,225 accounts were affected between mid-April and early June 2026, including the Obama White House, US Space Force, and Sephora accounts. Accounts protected by two-factor authentication received reset requests but resisted takeover.
A second case, the Replit Agent database deletion, showed the destructive variant. Replit acknowledged an incident in which its Agent deleted data from an application’s database; the prior architecture allowed development activity to affect production data, and the company subsequently separated development and production databases.
Network-layer indicators
- Tool-call traffic (API calls, database queries, email sends, file writes, shell-execution proxies) originating from an agent identity that exceeds baseline volume or targets unexpected resources
- Outbound connections from agent runtimes to external domains, especially after the agent has ingested content from email, tickets, or web sources
- Privilege-escalation patterns: an agent identity that normally operates read-only suddenly issuing write or admin requests
- Anomalous DNS lookups or outbound connections from agent identities
Security pillar of SASE control mapping
- ZTNA: Prevent and Contain. Restricts which internal services an AI-enabled identity can reach, reducing the blast radius of autonomous or manipulated tool actions.
- CASB / SWG: Prevent and Detect. Applies policy to AI applications and outbound services, blocking unsanctioned destinations and enforcing acceptable use for agent-driven traffic.
- Network Analytics: Detect and Investigate. Surfaces unusual destinations, request volume, privilege use, and action sequences that indicate an agent has exceeded its expected operating pattern.
Excessive Agency converts a model failure into a network action. The network is the last consistent enforcement point before the action reaches email servers, databases, cloud APIs, or external webhooks.
LLM04: Supply Chain
What is supply chain risk?
Supply Chain risk is what you inherit when any third-party component in the generative AI lifecycle is compromised. That includes pre-trained base models from open repositories, fine-tuning datasets, commercial model APIs, agent plugins, Python libraries, container base images, and Model Context Protocol (MCP) servers.
What changed in 2026
Supply Chain moved from #3 to #4, but its scope became broader. OWASP specifically calls out model artifacts, provenance, conversion and merge workflows, mutable references, and unsafe serialization.
Real-world incident
In March 2026, a threat group tracked as TeamPCP published two malicious versions of the litellm package (v1.82.7 and v1.82.8) to PyPI. The compromise originated in LiteLLM’s own CI/CD pipeline, where the Trivy scanner exfiltrated the project’s PyPI publishing tokens. The poisoned releases ran a malicious .pth file on every Python startup, harvesting AWS, GCP, and Azure tokens, SSH keys, and Kubernetes credentials. They were live for roughly 40 minutes before PyPI quarantined them, long enough to reach an estimated 2,488 corporate domains.
Network-layer indicators
- Downloads of model weights, adapters, or datasets from public hubs such as Hugging Face that lack expected signature or hash verification
- Traffic to package registries that resolves newly registered or low-reputation package names suggested by coding assistants
- Connections from CI/CD or model-serving infrastructure to unexpected external endpoints during build, load, package installation, or model initialization
- Follow-on command-and-control traffic from a malicious artifact after it loads
Security pillar of SASE control mapping
- SWG: Prevent and Detect. Restricts access to unauthorized repositories and artifact sources, and blocks suspicious downloads from low-reputation or unsanctioned locations.
- CASB: Prevent and Contain. Applies policy to sanctioned cloud development services and limits access to approved repositories, services, and identities.
The network can tell you where the model came from and where it connects afterward. It usually cannot tell you whether the model itself is malicious.
LLM05: Data and Model Poisoning
What is data and model poisoning?
Data and Model Poisoning is the attacker reaching your data before your model does. By manipulating pre-training datasets, fine-tuning corpuses, embedding data, or RAG document repositories, an adversary plants backdoors, systemic biases, security vulnerabilities, or degraded performance. Poisoning can create sleeper agents that behave normally during standard evaluation but reliably execute malicious actions the moment a specific trigger phrase appears.
What changed in 2026
The category moved from #4 to #5 and now explicitly spans the broader GenAI lifecycle. OWASP distinguishes it from Prompt Injection, which owns runtime malicious instructions, and from Vector and Embedding Weaknesses, which owns attacks against embedding geometry.
Real-world incident
In October 2025, Anthropic, the UK AI Security Institute, and the Alan Turing Institute reported that as few as 250 malicious documents could create a backdoor in models ranging from 600 million to 13 billion parameters in their experimental setup.
Network-layer indicators
- AI web crawlers and data-ingestion pipelines establishing outbound connections to newly registered, recently transferred, or known parked domains
- A user or service account suddenly uploading large numbers of documents into a repository that feeds an AI system
Security pillar of SASE control mapping
- SWG: Prevent and Detect. Enforces reputation-based domain filtering on data-crawling infrastructure, blocking AI ingestion scrapers from downloading content from newly registered, parked, or low-reputation domains.
- CASB and Cloud Data Security: Detect and Investigate. Audits file modification and synchronization events across enterprise cloud storage services connected to RAG pipelines.
- ZTNA (Zero Trust Network Access): Prevent and Contain. Enforces identity-aware micro segmentation on write access to internal RAG repositories, vector database ingestion endpoints, and fine-tuning pipelines.
Poisoning is fundamentally an integrity problem: an attacker compromises your source of truth before your model or retrieval engine ever reads it. The network can protect the pipeline, but it cannot prove that the model learned the wrong thing.
LLM06: Unbounded Consumption
What is unbounded consumption?
AI inference is not free and attackers know it. Every token a model generates costs money, and Unbounded Consumption is the class of attacks that exploit this: adversarial inputs that maximize output length, agentic loops that never terminate, and tool-call storms that burn compute in bursts. The goal is not to take the system down but to leave it running and bankrupt you, an attack the industry now calls denial of wallet.
What changed in 2026
This was the biggest climb on the 2026 list, up four places to sixth, and mainly two things drove it: context windows grew from 8k to 128k to a million, so one abusive request now does far more damage, and extended-thinking models have become mainstream in production since 2025, and can burn a hundred times the tokens of a normal completion on internal reasoning the user never sees.
Real-world incident
The numbers are already ugly. Sysdig’s LLMjacking research caught attackers running inference on stolen AWS Bedrock credentials at 46,000 dollars a day, and in March 2026 a stolen Gemini API key burned 82,000 dollars in 48 hours. Neither attack touched the model itself. They just spent the victim’s access until someone read the invoice.
Network-layer indicators
- Sharp rise in request and response sizes to AI API endpoints (token volume shows up as payload size on the wire)
- Sustained high-frequency inference calls from a single user, host, or service account
- Tool-call storms: rapid agent-to-tool back-and-forth, the signature of a runaway loop
- Inference traffic from credentials or hosts with no business reaching a model provider (the LLMjacking tell)
- Off-hours or geographically anomalous spikes to AI endpoints
Security pillar of SASE control mapping
- SWG / GenAI Firewall: Prevent and Detect. Enforces per-user and per-session rate limits and request-size caps. Frequency caps alone do not stop a single deeply nested tool loop, so pair with anomaly detection on token volume and tool-call frequency.
- CASB: Prevent and Contain. Restricts which model tiers an identity can reach, shrinking the blast radius of a leaked key.
Denial of wallet is visible on the wire long before it is visible on the invoice. Catching it at the network layer costs a rate-limit rule; catching it 30 days later costs whatever the attacker decided to spend.
LLM07: Misinformation
What is misinformation?
Misinformation is what happens when a model makes something up and says it with a straight face. Sometimes it is a wrong number in a report, sometimes a fabricated legal citation, and sometimes it is the name of a software package that does not exist, until an attacker creates it.
What changed in 2026
Misinformation climbed from ninth to seventh, but the ranking undersells the story, as it was the single biggest disagreement between the experts and the data. Practitioners voting on the list put it near the bottom, but the classified incidents put it near the top. For the first time the 2026 edition weighted real incidents, and it said misinformation is doing far more damage than the experts assumed.
Real-world incident
In 2026, the damage moved upmarket. Deloitte refunded 290,000 dollars after a government report it produced turned out to contain hallucinated content, a case that helped trigger a FINRA crackdown on GenAI in financial services. Weeks later, an investigation into an EY Canada report found most of its citations fabricated.
The security-relevant version is slopsquatting. AI coding assistants hallucinate package names that sound real but do not exist. Attackers watch for the common ones, register them, and wait. The npm package “unused-imports”, a name models invent in place of the legitimate “eslint-plugin-unused-imports”, was still pulling roughly 233 downloads a week after being flagged. A wrong answer became a live supply-chain foothold.
Most of misinformation never touches the network; you cannot inspect a packet and know a fact is wrong. Slopsquatting is the exception that the network sees clearly.
Network-layer indicators
- Dependency installs and package pulls reaching newly registered or low-reputation registries
- Requests for package names matching known slopsquat or typosquat watchlists
- Developer or CI/CD hosts connecting to package sources outside the approved mirror
- First-seen domains in the software supply-chain path, especially during build and install
Security pillar of SASE control mapping
- Application layer owns the accuracy problem: grounding, retrieval with citations, and human review.
- SWG: Prevent and Detect. Blocks pulls from known-malicious and typosquat package sources.
- CASB: Prevent and Contain. Restricts developers and build systems to approved registries and mirrors.
- Threat intelligence (egress): Detect. Flags the first connection to an attacker’s freshly registered package.
We cover this pattern in depth: The Rise of Slopsquatting: A New Software Supply Chain Threat.
Misinformation is where the application layer must lead. The network’s job is to make sure a confident mistake doesn’t become a compromise.
LLM09: Vector and Embedding Weaknesses
What are vector and embedding weaknesses?
Retrieval-augmented generation gave models a memory: a vector database full of embedded documents the model pulls from to answer questions. That database is a new asset holding old secrets, and it has its own attack surface. Vector and Embedding Weaknesses is the risk that the retrieval layer leaks, whether through a misconfigured API, a poisoned document, or the embeddings themselves.
What changed in 2026
This entry slipped one place, from eighth to ninth, but the scope grew. OWASP widened it to cover cross-encoder reranking poisoning and, more importantly, embedding inversion: the recovery of original text from the vectors themselves. The 2025 assumption that embeddings were safe to store and share did not survive contact with the research. The takeaway is blunt: an embedding is not a hash, and a vector database is not a safe place to lose control of.
Real-world incident
The theoretical became financial. In a breach spanning 2024 and 2025, attackers compromised a fintech’s Pinecone vector database and ran reconstruction attacks against the embeddings, recovering millions of client investment portfolios from vectors that were never supposed to be reversible.
The recovery rates are not marginal. Georgia Tech’s Vec2Text work reconstructed 92 percent of the original text from short 32-token embeddings, and later training-free methods generalized the attack across different embedding models. If an attacker has your vectors, assume they have your text.
Network-layer indicators
- Anomalous query patterns to the vector database API: bulk retrieval, systematic enumeration, or volumes far above the app’s normal rate
- Access to the vector database from identities or hosts outside the RAG application’s known service accounts
- Cross-tenant data appearing in retrieval results, responses carrying another tenant’s identifying markers
- High-volume embedding API calls to external providers, the signature of a bulk extraction or inversion attempt
- Data flowing to embedding services that are not on the approved list
Security pillar of SASE control mapping
- ZTNA: Prevent and Contain. Restricts access to the vector database and embedding endpoints to the RAG app’s identity, per request.
- DLP: Detect. Inspects data moving to and from embedding services.
- SWG / CASB: Prevent. Confine embedding to approved providers.
You secured the database the documents came from. The embedded copy in your vector store deserves the same controls, and usually has none.
LLM10: Improper Output Handling
What is improper output handling?
Improper Output Handling is the oldest trick on the list wearing a new hat. A model generates output, a downstream system trusts it, and that output turns out to contain SQL, a shell command, a malicious URL, or a script. The LLM is not the target, it is the delivery vehicle. Think of it as the back half of an attack: prompt injection convinces the model to generate something malicious, and Improper Output Handling is the downstream system executing it without a second look. One provides the payload, the other pulls the trigger.
What changed in 2026
Down five places, the steepest drop on the list, and for a good reason. Teams learned to sanitize model output the way they sanitize user input, and incidents fell. The ranking rewards the progress. It does not mean the risk is gone, only that the baseline got higher.
Real-world incident
CVE-2023-29374 is the textbook case. LangChain’s LLMMathChain took a math question, let the model write Python to solve it, and ran that Python with exec(). An attacker phrased the question so the generated code was a shell command. The result was remote code execution, rated CVSS 9.8, straight through the model.
CVE-2024-0440 in AnythingLLM shows the SSRF variant. An attacker steered the model into generating internal URLs like file:///etc/passwd and http://localhost:8080/admin, which the application then fetched on the attacker’s behalf, exposing internal files and services from the inside.
Network-layer indicators
- Injection payloads (SQL, shell metacharacters, script tags) in traffic from the AI service to downstream application servers
- SSRF attempts: AI-generated requests targeting internal IP ranges or the cloud metadata endpoint 169.254.169.254
- Outbound requests to newly seen or attacker-controlled URLs embedded in model output, including markdown image loads with data in the query string
- Downstream servers fetching file:// or localhost URLs that originated in an AI response
Security pillar of SASE control mapping
- WAF / IPS: Prevent and Detect. Inspect traffic at the model-to-downstream hop for injection payloads, exactly as they would for any untrusted source.
- SWG: Prevent and Contain. Blocks SSRF attempts against internal ranges and the metadata endpoint, and stops outbound fetches to the attacker URLs used for markdown exfiltration.
- Application layer: treat model output as untrusted input. Parse it, do not execute it, and prefer structured formats.
The model is not special. Its output is untrusted input with better grammar, and the network has been catching untrusted input for decades.
Securing GenAI with Network Visibility
As enterprises adopt GenAI applications, the network becomes a critical control point. It sits outside the model’s trust boundary, so it can catch what app-layer controls miss. Guardrails still matter. They’re just not enough alone.
