In this episode, I sit down with longtime security leader, former CISO, Co-Lead of the 2026 OWASP Top 10 for LLM Applications and my friend, Rock Lambros, to discuss the new list, including the incident data that nearly pushed prompt injection out of the top 10 and why the working group kept it at number one anyway.
I recently wrote a piece on the new publication called It Was Never the Model, and this conversation goes deeper on that theme, from where the LLM and Agentic lists are converging to why Rock argues that agency is not authorization.
We chatted about:
Why the LLM Top 10 and the Agentic Top 10 are merging in practice, with excessive agency as the biggest mover driven by connector, tool, and MCP usage
The letter from the project leads, and why the security side of the industry was slow to say plainly that the model was never the thing to secure
Prompt injection, which the incident data alone would have ranked around twelfth, and why the community vote carried it to number one
Misinformation, where voters put it near the bottom and the incident record put it near the top
Hidden Context Exposure, soft guardrails, and why instructions and data sharing one context window is the core problem
Context rot and why agents doing critical work need disciplined context window management
Using AI to govern AI, and the dual-layer model in the Agentic Control Standard
Agency versus authorization, and what the flood of agentic identity drafts at IETF signals about OAuth
Prefer to listen?
Find the episode on Spotify and Apple Podcasts.
Please be sure to subscribe and leave the show a rating/review, as it truly helps!
Takeaways
The lists are converging whether we like it or not
Rock came to the LLM Top 10 co-lead role after spending most of his time on the agentic side of the OWASP GenAI project, and his read is that the two lists are merging. Agents call a model underneath, so the LLM work is the foundation for the agentic work. The 2026 list draws a boundary where the LLM list owns the model as a component and the Agentic list picks up once the model is handed capabilities and downstream consequences, but Rock admits tool calls had to be pulled back into the LLM side. Excessive agency was one of the biggest movers on the list this year, and he attributes that directly to connector, tool, and MCP usage. As he put it, when you are sitting at a desktop AI client with tools connected, “there’s effectively not a difference.” The only distinction left is whether another task keeps running after you walk away.
I see the same convergence, and the v2 State of Agentic AI Security and Governance report makes a related point about safety and security blurring. A model or agent that gets compromised and a model or agent that simply behaves in a way you did not anticipate both land on the same security and governance risk register.
Prompt injection nearly fell out of the top 10, and why it did not
This is the first year the list was tested against incident data rather than practitioner judgment alone, and the headline result is that prompt injection would have fallen out of the top 10 if the ranking followed the data. Rock gave two reasons. Vendors and organizations have invested in prompt injection guardrails, so fewer clean exploits surface. And incidents get reported by their outcome, whether that is misinformation or hidden context exposure, rather than by the initial vector that caused them. He also cautioned against reading too much into the point estimate. “On the surface, it looks like prompt injection would have been number twelve, if we went just based on the data. But the confidence interval on that would have had it anywhere from four to eighteen.”
Rock’s underlying position is that “it is mathematically impossible to solve prompt injection,” which is why the letter from the project leads tells people to assume the model will be fooled and build the system around it. He was careful to say that does not mean stop investing in input validation. It means treating prompt injection the way we have treated breaches for the last decade, as a when rather than an if. The working group still landed on number one, and Rock said “it would almost be negligent if it wasn’t,” because prompt injection is the mechanism through which most of the rest of the list gets realized. My own read is that this matches what I see in the research community, where almost every new finding against AI and agent systems traces back to a direct or indirect injection as the initial vector.
The data is noisy, and its biggest value was the argument it started
Rock was candid about the limits of the incident corpus. It was one year of data pulled from five or six sources, reported inconsistently, and the working group weighted it at 25 percent against a 75 percent community vote for exactly that reason. Three entries could not be matched between the vote and the data at all. Misinformation ran the other direction from prompt injection, with voters placing it near the bottom and the record near the top, and Rock’s explanation is simple. Nobody files an incident report when they spot a hallucination. It gets reported when the hallucination led to something harmful downstream.
His honest assessment was that “if nothing else, what the data did is just drive conversation.” Dropping the finding that prompt injection was not in the top 10 into the working group Slack produced a real debate, and the group still had to argue its way to a ranking. I think that is the right way to hold this. The data did not validate the list, and Rock did not claim it did. It gave practitioners something concrete to argue against, and he expects the model to improve as the corpus grows and as the same process gets applied to the Agentic Top 10.
Soft guardrails and the context window problem
I asked Rock how much of what the market is selling, from prompt firewalls to guardrail models to LLM-as-a-judge, is still soft guardrail territory, and his answer was that we are still seeing a ton of it. The deeper issue is architectural. A firewall can allow or deny traffic on a port and inspect the application layer. In an AI system, instructions and data are bundled together into one context window, and while there are papers on separating the instruction layer from the data layer, “by and large, it’s still just a big mesh of information.” He is not convinced the transformer architecture will ever be able to distinguish instruction from data with full certainty.
That leads to context rot. The first token carries more weight than the 250,000th, and fidelity degrades as the window balloons. For a casual conversation that is fine. For an agent performing a critical action, Rock’s advice is to keep the context window as small as possible while still giving the agent what it needs to do the job, or you start seeing hallucinations and misinformation surface. The Hidden Context Exposure entry in the 2026 list, which says privilege separation and authorization checks must not be delegated to the LLM, follows directly from this.
Agency is not authorization
When I asked what security leaders should keep in mind about excessive agency, Rock led with “Agency’s not authorization. Period.” Authorization tells you whether the agent can do the thing. Agency tells you whether the thing it is doing is appropriate and allowed. Agents need to make decisions by definition, and if a workload does not need to make decisions, it does not need to be an agent. That is automation, and we have been doing it for decades.
He pointed to the more than one hundred agentic identity drafts sitting at IETF right now, many authored by the creators of OAuth, as a signal. His read is that they are telling us OAuth is what we have rather than the solution, and that organizations will need to layer on mechanisms that detect in near real time when agents execute beyond their scope and then stop or steer them. That is what the Agentic Control Standard, which is moving back into OWASP, is trying to provide as a middleware layer, so a security leader does not need a separate control set for every platform their developers and citizen developers are building on. Given how many platforms and configurations are already in play, some kind of uniform standard is the only path I see that does not end in a mess.
Getting involved
Rock also addressed the circular logic in our space, where the answer to AI risk keeps being more AI.
His position is that a multi-layered approach is the only thing that scales. The Agentic Control Standard uses a dual-layer model, with deterministic policy as code in tools like Rego and Cedar first, and an LLM-as-a-judge only when the deterministic rule’s outcome is in question. He was clear that classifiers are limited by the quality and volume of the data behind them, including the one he built for this year’s Top 10 update. As he summed it up, “the only way to scale this is to use AI to govern AI and to secure AI.”
If you want to contribute to any of this work, Rock’s directions were simple.
Go to genai.owasp.org/contributing, follow the instructions at the bottom of the page to join the OWASP Slack, and DM him once you are in. OWASP has become, in my view, the definitive source of authority on securing and governing AI and agents while formal compliance frameworks catch up, and the groups Rock is leading are writing the standards the industry will be working from.
Thanks again to Rock for joining me. You can follow his work on LinkedIn and through the OWASP GenAI Security Project.
