How Zenity Implements the 2026 OWASP Top 10 for LLM Applications

Every AI security framework names the risks you have to control. Zenity is built to implement those controls at runtime. Here's the 2026 OWASP Top 10 for LLM Applications, entry by entry, with the gaps marked honestly.

Paste a booby-trapped instruction into a chat window, and nothing much happens. The model reads the poisoned text, maybe repeats something dumb or coughs up a snippet it shouldn't, and you close the tab. Give that same model a tool, a token, and a mailbox, and the same instruction turns into an exfiltration run at your privilege level. Nothing about the model changed. What changed is that it can act.

That is the whole story of the 2026 OWASP Top 10 for LLM Applications, and Zenity is the platform built to close it. As you read this, ask yourself, “Is this a model risk, or does it only detonate once the model can act?” Zenity watches what the model does at runtime and blocks the action before it happens.

What Is the 2026 OWASP Top 10 for LLM Applications?

The 2026 OWASP Top 10 for LLM Applications is the current list of the most critical security risks in applications built on large language models, published by the OWASP GenAI Security Project. I co-lead the 2026 edition with project founder Steve Wilson. It leads with Prompt Injection (LLM01), Sensitive Information Disclosure (LLM02), and Excessive Agency (LLM03), and it covers the model as a component inside an application. When the model becomes an actor with tools and memory, you pair it with the OWASP Top 10 for Agentic Applications 2026, which picks up at ASI01.

Zenity maps to this list, where a runtime control can actually change the outcome. It detects the attack as it happens, blocks the resulting action, and it's straight about the entries where it only covers part of the risk. I'll get to those.

What Changed From the Previous OWASP LLM Top 10?

The 2026 list re-ranks the 2025 list, but doesn't change the cast of risks. All ten classes carried over; however, the order shifted toward agents, and one entry got a new name.

Prompt Injection and Sensitive Information Disclosure held their ground at first and second. The headline move is Excessive Agency, which jumped from sixth in 2025 to third in 2026, which is where the incident data behind the revision pointed. Unbounded Consumption climbed from tenth to sixth, and Misinformation moved from ninth to seventh. Improper Output Handling fell the other way, from fifth all the way to tenth. Supply Chain, Data and Model Poisoning, Hidden Context Exposure, and Vector and Embedding Weaknesses each slid down one slot. The one rename is System Prompt Leakage, now Hidden Context Exposure (LLM08), broadened to cover hidden context and not just the system prompt. If you built controls against the 2025 numbering, the class names still hold, but re-read LLM01. Its scope widened in 2026 to cover cross-modal injection, memory persistence, and agentic blast radius. What changed is which risks OWASP says deserve your attention first, and how far LLM01 now reaches.

How Does Zenity Map to the 2026 OWASP LLM Top 10?

One disclosure before the table. I co-lead the 2026 edition of this list, which means I care a great deal about the taxonomy being used correctly. It does not mean OWASP endorses Zenity or any other vendor. The list is vendor-neutral. The mapping below is Zenity's own.

Zenity covers this list from two directions. AISPM surfaces weak configurations before anything runs. AIDR detects threats at runtime, and Inline Prevention, its real-time enforcement path, blocks the offending action on the platforms where it's supported. Prevented actions land in the same AIDR findings view. AIDR's engine is hybrid: deterministic rules mapped to OWASP LLM and MITRE ATLAS, plus LLM-based intent-aware detections that run asynchronously. The framework tags are wired into detection. The coverage mapping below is still mine to defend, not OWASP's.

Prevent applies on platforms where Zenity runs inline, meaning Copilot Studio, Microsoft Foundry, and coding agents through hooks. On poll-only platforms such as M365 Copilot, Agentforce, Vertex AI, Gemini Enterprise, and ServiceNow, coverage is detection and posture only.

Model Context Protocol (MCP) shows up in that LLM04 row because agents reach tools and data through MCP servers, and most inventories miss them.

Which Risks Are Harmless Until the Model Can Act?

Three entries look like model problems and only turn into incidents at the boundary where the model can act: Prompt Injection (LLM01), Improper Output Handling (LLM10), and Misinformation (LLM07). Each one is inert text until something downstream trusts it.

Prompt injection is the cleanest example. Direct injection is a user typing something nasty into the box. Indirect injection is the dangerous one, where the poisoned instruction rides in on a document, a web page, or an email the model reads on its own, and Zenity Labs has been demonstrating how those techniques work in practice since 2024, most recently against prompt-injection guardrails themselves. Aim Labs showed how far that goes with EchoLeak, a zero-click data leak out of Microsoft 365 Copilot. Zenity Labs' own AgentFlayer research did it across ChatGPT, Copilot Studio, Salesforce Einstein, and Gemini, where a single poisoned artifact, a shared document, a support case, or an email, was enough and the victim never clicked a link. AIDR catches the injection, including instructions buried in uploaded files and pulled in from external data, and it tracks the whole thread rather than one message at a time. Inline Prevention Prompt Injection Defense blocks the action it tries to trigger on supported platforms.

Inline Prevention's Risk Filtering covers the toxicity and unsafe-content end of the output surface, and the malicious links and hidden text fall under LLM10. Neither one is a misinformation control. Hallucination and factual accuracy (LLM07) aren't a Zenity control, so you still need to validate the output of your agents.

Which Risks Get Worse When the Model Becomes an Agent?

Excessive Agency (LLM03) and Sensitive Information Disclosure (LLM02) stay manageable while the model just talks, and they turn into losses the moment it can act and reach data.

Excessive Agency climbed to third in 2026 for a reason. An over-permissioned LLM that can call tools is a standing incident that’s just waiting for a trigger. The model doesn't need to be jailbroken in some exotic way. It needs more scope than the task requires and one bad instruction. Zenity comes at this from two sides. AISPM surfaces the over-provisioned access before it ever gets used: the agent that can touch far more than its job needs. Inline Prevention Tool Misuse Prevention blocks the unsafe tool call at runtime, and on Copilot Studio, AISPM can push a remediation that forces end-user confirmation before an agent runs a sensitive task.

Sensitive Information Disclosure follows the same path. The confidential data was always sitting there, but what opens the exfiltration channel is a model that can read it and send it somewhere. AIDR detects PII, financial data, and secrets in the flow, and Inline Prevention Sensitive Data Blocking stops the leak before delivery, not in a report you read the next morning. That timing is the point. A detection that fires after the data already left documents the loss. It doesn't stop it.

Which Risks Live in the Supply Chain and the Data Layer?

The rest of the list sits lower on the action boundary and leans toward posture, and this is where honesty earns more trust than a coverage claim. Zenity covers Supply Chain (LLM04) well as posture. LLM05, LLM08, and LLM09 it covers in part, LLM06 it doesn't cover at all, and I said my piece on LLM07 above. I'll be specific about each.

Supply Chain is a posture problem, and Zenity treats it as one. AISPM inventories and risk-scores the third-party AI integrations wired into your environment, generates an SBOM for the Power Platform canvas apps most inventories skip entirely, and it discovers connected MCP servers, including the shadow ones sitting on developer machines, so you know what your agents can actually reach. You can't govern what you can't see, and most teams can't see this layer at all.

Here are the remaining partials, specifically:

• Data and Model Poisoning (LLM05): AIDR catches malicious input reaching agents at runtime, and Zenity does not monitor your training or model-artifact pipelines, so poisoning that happens upstream in training is outside the product.
• Unbounded Consumption (LLM06): not a Zenity control. There's no AI-specific rate limit, no inference ceiling, no cost guardrail.
• Hidden Context Exposure (LLM08): AIDR output monitoring and secrets detection catch some leakage of sensitive context, and full system-prompt-extraction defense is broader than what the product does.
• Vector and Embedding Weaknesses (LLM09): Zenity detects anomalous data access at runtime, and vector-store and embedding integrity isn't a core control yet.

Why Do Static Posture Tools Miss the Runtime Risks?

They miss them because the dangerous part happens at runtime, and most of the tooling teams already bought look at things at rest. Two categories make it concrete: non-human identity governance and data security posture management.

Non-human identity tools inventory your machine identities and the permissions attached to them. They're good at that, and that's the whole point: the answer they give you is a snapshot. They'll tell you an agent's service account can reach the CRM and the file store. They won't tell you that three minutes ago the agent read a poisoned support ticket and used exactly that access to email customer records to an attacker. Data security posture management (DSPM) has the same shape. DSPM scans data at rest, classifies it, and flags where the sensitive material lives. That's useful, and it's every bit as static. It maps the vault. It doesn't watch the model open it.

That's the gap the 2026 list keeps circling. Prompt injection, excessive agency, sensitive disclosure, and improper output handling are all runtime events. The instruction arrives, the model decides, the action fires, and it's over in the time it takes to call an API. A scanner that ran last night was looking at a different building. The risks that moved up the 2026 list are the ones that only exist while the system is running, and you can't catch a runtime event with a posture snapshot. That's the gap Zenity is built for.

Which of These Can Zenity Detect and Block at Runtime?

Three entries Zenity both detects and blocks inline: Prompt Injection (LLM01), Sensitive Information Disclosure (LLM02), and Improper Output Handling (LLM10). Excessive Agency (LLM03) it blocks at the tool call and surfaces as posture. The rest it covers as posture or in part, and the table above marks each one.

It integrates with the AI platforms themselves, which hand Zenity the prompt, the tool call, and the output for evaluation while the request is still in flight, so the verdict comes back before the action lands. No network gateway squinting at traffic from the outside, and on these platforms no SDK to bake into every agent. Today Zenity blocks inline on Microsoft Copilot Studio (generative orchestration, tool calls only) and Microsoft Foundry (documented as Azure AI Foundry in the integration guide) through native platform webhooks, and on coding agents through hooks: Cursor (Cursor Enterprise), Claude Code, and GitHub Copilot, with OpenAI Codex rolling out. For homegrown agents with no platform to hook, you call Zenity's Evaluate API from your own code. One thing to set correctly: policies ship in Detect mode. Blocking is a switch you flip per policy.

Line the modes up against the list, and the pattern is clear. Zenity detects and prevents on prompt injection, sensitive disclosure, and improper output handling, the three that detonate at the input and output boundary. It runs posture plus prevention on Excessive Agency, which lives in both the setup and the moment. It runs posture on Supply Chain. It labels poisoning, misinformation, hidden context, and vector weaknesses as partial, and unbounded consumption it doesn't cover at all, because I'd rather you know the edge of the coverage than trip over it during an incident.

The Model Is Where the Risk Is Born. The Agent Is Where It Goes Off.

Back to the question I asked you to hold. Is this a model risk, or does it only detonate once the model can act? For most of the 2026 list, the honest answer is the second one. The model is where the risk is born. The agent is where it goes off. You can map the whole Top 10 on a whiteboard and still lose, because the list tells you what to worry about and not when it happens. It happens at runtime, at the boundary where the model stops talking and starts doing.

That's the boundary Zenity was built to hold. Catch the attack as it happens, block the action before it lands, and know the difference between the risks you've closed and the ones you've only mapped. If you want to see where your own agents stand against the 2026 OWASP Top 10 for LLM Applications, Zenity can walk you through it.

Frequently Asked Questions

What is the 2026 OWASP Top 10 for LLM Applications? It's the current OWASP GenAI Security Project list of the ten most critical security risks in LLM-based applications, led by Prompt Injection, Sensitive Information Disclosure, and Excessive Agency. It covers the model as a component. When the model acts as an agent, you pair it with the OWASP Top 10 for Agentic Applications 2026.

What changed from the previous OWASP LLM Top 10? The 2026 list re-ranks the 2025 list without changing the risk classes. Prompt Injection and Sensitive Information Disclosure held the top two, and Excessive Agency jumped from sixth to third, following the incident data behind the revision. Improper Output Handling fell from fifth to tenth, Unbounded Consumption rose to sixth, and System Prompt Leakage was renamed Hidden Context Exposure.

What is prompt injection in the OWASP LLM Top 10? Prompt injection (LLM01) is input that alters the model's behavior, either directly from a user or indirectly through content the model reads, like a document or a web page. It's low-risk in a chat window and high-risk once the model can call tools, because the injected instruction then runs at the user's privilege.

Where does model risk become agent risk? At the point the model can act. The OWASP Top 10 for LLM Applications covers the model as a component. Once it has tools, memory, and downstream consequences, the risk moves to the OWASP Top 10 for Agentic Applications 2026. Zenity detects and blocks at that boundary at runtime.

Which OWASP LLM risks can Zenity detect and block? Zenity detects and blocks Prompt Injection, Sensitive Information Disclosure, and Improper Output Handling inline. It blocks Excessive Agency at the tool call and surfaces it as posture. It covers Supply Chain as posture, and it marks Data and Model Poisoning, Misinformation, Hidden Context Exposure, and Vector and Embedding Weaknesses as partial, and it does not cover Unbounded Consumption.