OWASP GenAI Security Project releases 2026 LLM Top 10 and Agent Control Standard
The OWASP GenAI Security Project said its latest guidance includes a new Agent Control Standard, expanded AI security advice, and a membership count above 30,000.
The OWASP GenAI Security Project said on Sept. 2, 2026, that it released a 2026 Top 10 for LLM Applications, introduced a new Agent Control Standard, and expanded its AI security guidance for generative and agentic systems.
The group said the guidance is intended to help teams identify and reduce security risks as large language models and autonomous AI agents move from pilot projects into broader enterprise deployment.
According to the project, the 2026 Top 10 for LLM Applications is its flagship guidance for identifying and mitigating security risks in LLM-powered applications. It said the new edition passed 10,000 downloads in its first 48 hours and was developed with contributions from hundreds of AI security experts. The project also said the work draws on thousands of real-world AI security incidents and expands mappings to NIST, MITRE ATLAS, CWE, and its Top 10 for Agentic Applications.
The announcement also included a community update. The project said its worldwide membership passed 30,000 and that it added four new industry sponsors: F5 and WitnessAI as Gold Sponsors, and Evoke Security and Mondoo Inc. as Silver Sponsors.
Scott Clinton, chair and co-founder of the project, said generative AI security has moved from an emerging concern to an operational priority. He said the need for open, practical guidance was reinforced by what the group saw at Black Hat and DEF CON this summer.
Steve Wilson, who is identified in the source as founder of the Top 10 for LLM, a board member at the OWASP GenAI Security Project, and chief AI and product officer at Exabeam, said the 2025 Top 10 reflected practitioner concerns as generative AI entered the enterprise. He said the 2026 work tested community expertise against thousands of real-world incidents and that AI is moving from content-generating models to autonomous agents.
Wilson said security must evolve with that shift and include enforceable controls around what such systems can access, decide and do.
The source also describes OWASP as an online community that produces freely available security resources, and says the OWASP Foundation is a U.S. 501(c)(3) non-profit established in 2004.
The new guidance now goes to developers, security teams and vendors working with LLM and agentic systems.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
View the Web StoryA visual, tap-through version of this reportThis is the AMP version of the article. Read the full article on Atlas Watchline.