Skip to content

Back to the catalog

Incident-Data Robustness Analysis of the OWASP Top 10 for LLM Applications (2026): How a Community-Expert Ranking Holds Up Against a Large-Scale LLM Incident Corpus
arxiv.orgpaper

Incident-Data Robustness Analysis of the OWASP Top 10 for LLM Applications (2026): How a Community-Expert Ranking Holds Up Against a Large-Scale LLM Incident Corpus

This arXiv paper stress-tests the OWASP Top 10 for LLM Applications (2026) community-expert ranking against a large-scale corpus of real LLM-security incidents (7,714 snapshotted, 6,639 labeled) drawn from CVE, GHSA, OSV, and AIAAIC. Using a Bayesian measurement-error model to correct incident counts for classifier precision/recall, the authors find weak agreement between the expert ranking and the incident-based ranking (Cohen's kappa about 0.20), yet the expert list proves robust: a bake-off of four frontier LLM classifiers fails to beat a simple incidence-floor baseline (balanced accuracy 0.863, Spearman rho = 0.918 against held-out ground truth). It is framed as an exploratory analysis by two OWASP working-group members, not an official supersession of the list.

TL;DR A data-driven audit of the 2026 OWASP Top 10 for LLM Applications finds weak agreement with real incident data, but the expert-curated ranking still beats LLM-classifier baselines.
Open original ↗
Document

What it is

An exploratory analysis by two OWASP LLM Top 10 working-group leads (Kyriakos Lambros, Steve Wilson) that checks the expert-consensus ranking against an incident corpus. Beyond the headline weak agreement (Cohen's κ ≈ 0.20, interval crossing zero) and robust expert list, the paper documents how the published 2026 list is actually built and which taxonomy entries have measurement you can and cannot trust.

How the 2026 list is made

The published ranking is a fixed-weight blend in score space: 0.75 on the practitioner vote (≈29 respondents), 0.25 on the incident data. The split is deliberately lopsided — at quarter weight the data can move a risk a full tier when signals diverge, but cannot overturn consensus on one noisy corpus. The one incumbent with a clear stated move is Excessive Agency, entering the tied middle band. The field was 20 candidates: 10 incumbents (LLM01–10), 6 NEW- tracked-but-unpublished, 4 ROLL- narrower risks folded into parents (child incidents count toward the parent).

Which measurements to distrust

The corpus was classified by a three-model ensemble (Qwen 235B, Llama 405B, DeepSeek V3) voting. Per-entry precision, measured against a 1,200-incident human-adjudicated gold set plus 323 hand-verified checks, varies sharply:

  • LLM01, LLM03: 93% — clean.
  • LLM08 (Vector and Embedding Weaknesses): 13% — lowest; ~7-to-1 against a labeled incident truly belonging. Confused with data-and-model-poisoning (LLM04).
  • LLM07 (Hidden Context Exposure): 31% — confused with prompt injection (LLM01), because attackers expose hidden context to craft injections.
  • ROLL-CFAS: 33%, ROLL-CMSB: 44% — CFAS has one precision observation (90% interval 3%–78%; essentially unmeasured).

Low precision drives large upward count corrections and wide uncertainty in the Bayesian model — it flags unreliable measurement, not low importance.

Three entries take their rank from the vote alone because the corpus cannot estimate their recall: Data and Model Poisoning, Vector and Embedding Weaknesses, Unbounded Consumption.

Caveats the paper states

All 323 precision checks came from the security stratum (6,297 incidents from CVE/GHSA/OSV); the ai-harm stratum (342 from AIAAIC) has no precision measurement and falls back to a flat Beta(1,1) prior — so ai-harm corrections rest on weaker ground. A 46-incident agentic corpus reproduced only 26% of label assignments, reported as corroboration, not proof. Timing: the analysis ran before the August 2026 publication; it does not supersede the official list.

Technologies named here

Also named here

  • GHSA

Related in AI Security