AI Regulation Tracker  /  Security standard

OWASP ranks prompt injection the top agentic-AI threat and points to real CVEs, not theory

The OWASP GenAI Security Project's version 2.01 report reframes agentic AI risk around disclosed vulnerabilities and names prompt injection the leading threat. For anyone running AI agents on client data, it signals that "we will patch it" is no longer a defensible security posture.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published July 7, 2026  ·  Last updated July 7, 2026

The OWASP GenAI Security Project has published version 2.01 of its report State of Agentic AI Security and Governance, and the change in evidence is the story. The 2025 edition described threats that researchers expected to see. The 2026 edition documents ones that have already been disclosed, pairing categories of agentic risk with real CVEs, vendor advisories, and breach reports. At the center of that record sits one technique, prompt injection, which OWASP again ranks as the leading vulnerability and maps to six of the ten categories in its Top 10 for agentic applications.

From theory to disclosed vulnerabilities

Prompt injection is the manipulation of a model through text it treats as instruction. In an agentic system, that text does not have to come from the user. It can arrive inside a web page the agent browses, a file it summarizes, or output from another tool it calls. Because a language model does not draw a hard line between data and commands, content that looks like ordinary input can redirect the agent's behavior. The report's contribution this year is to show that this is not a whiteboard concern. It ties the pattern to specific, named incidents.

The CVEs the report leans on

Several of those incidents are worth naming, with the caveat that they are attributed findings from vendors and researchers rather than claims original to this article. Security firm Pillar Security reported an indirect prompt injection affecting the Gemini command-line interface in May 2026. A separately tracked vulnerability in the Cursor coding assistant, CVE-2026-22708, involved poisoning of an allowlisted command so that the agent would run attacker-chosen actions. Researchers also reported a command injection issue in ModelScope's MS-Agent tracked as CVE-2026-2256, and a March 2026 compromise of a LiteLLM package token on the PyPI registry. Readers should treat the exact scope of each as defined by its own advisory, not by this summary.

Why "we will patch it" does not hold

The harder claim in the OWASP material, and the one professionals should sit with, is that prompt injection behaves less like a defect and more like a property of how current models work. Security researchers increasingly describe it as a structural weakness rather than a bug a single release removes, because the same flexibility that lets a model follow natural-language instructions is what lets a hostile instruction slip through. Coverage of the release has cited a sharp year-over-year rise in prompt-injection incidents, with one figure of roughly 340 percent circulating in reporting. That specific number could not be independently confirmed against the report text and should be read as reported, not settled. The direction, however, is consistent across the disclosed cases.

What this does not mean

The report does not say agentic AI cannot be deployed safely, and it does not declare a single defense sufficient. Input filtering, model-side guardrails, and allowlists all reduce exposure, and none of them close the gap on their own. The point is architectural. If injection cannot be fully prevented, the sound response is to limit what a compromised agent can do. That means scoping an agent's permissions to the minimum, isolating tools and credentials, requiring human approval before consequential actions such as sending funds or deleting records, and logging agent activity so a bad instruction leaves a trail.

The duty this creates for professionals

For a CISO, a compliance lead, or a lawyer or accountant running client data through an agent, the framing carries a plain consequence. Once prompt injection is documented as a structural risk, deploying an agent without designing for compromise is a supervision and architecture choice, not a neutral one. A firm that points to a promised future patch after client data moves the wrong way has assumed a risk the current evidence says was foreseeable. The defensible posture is to build the workflow on the assumption that the agent will, at some point, read something hostile, and to make sure that moment cannot become a breach on its own.

That is the shift version 2.01 asks teams to make. Stop treating agent security as a patch queue, and start treating it as a design constraint that shapes what you let an agent touch in the first place.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.