--- title: "🛡️ OWASP LLM Top 10 2026 Major Reshuffle: Excessive Agency Rises to Third Place, Agentic AI Risk Officially Listed | AI Security Daily" description: "Mu Yan here, AI Security Daily: OWASP's August 2026 LLM Top 10 reshuffles 80% of entries, Excessive Agency jumps from sixth to third, thrusting the over‑permission problem of agentic AI into the spotlight; next, why BlueRadius's test of 21 cases all bypassed human review." canonical_url: "https://blog.markkulab.net/en/ai-security/ai-security-2026-11-07" author: "Mark Ku" author_url: "https://blog.markkulab.net/en/author/mark-ku" site: "Mark Ku's Tech Notes" date_published: "2026-11-07T02:00:00.000Z" category: "AI Cybersecurity Daily Report" tags: ["ai-security", "podcast", "AI 資安", "AI資安", "OWASP", "LLMTop10", "ExcessiveAgency", "PromptInjection", "AIAgent", "BedrockAgentCore", "CVE-2026-111497"] language: "en" license: "CC BY 4.0" license_url: "https://creativecommons.org/licenses/by/4.0/" attribution: "when reusing or quoting, credit the author and link back to the original" --- # 🛡️ OWASP LLM Top 10 2026 Major Reshuffle: Excessive Agency Rises to Third Place, Agentic AI Risk Officially Listed | AI Security Daily ## Opening Muyan here with the AI Security Daily. The OWASP LLM Top 10 2026 released in August reshuffled 80% of the entries, Excessive Agency surged from sixth to third, thrusting the over-permissioning problem of agentic AI into the spotlight. In a moment I'll tell you why BlueRadius's hands-on test of 21 cases found every single one bypassed human review. Today we're also covering Amazon Bedrock AgentCore falling to a single prompt, and how embedded browsers in mainstream editors have become springboards for host code execution. ## Today's AI Security Focus ### 1. OWASP LLM Top 10 2026 Released, 80% of Items Reshuffled, Excessive Agency Rises to Third - **What happened**: The OWASP GenAI Security Project published the 2026 edition of the LLM Top 10 in August 2026. Prompt Injection held the top spot for a fourth consecutive cycle. Excessive Agency climbed from sixth to third. System Prompt Leakage expanded into Hidden Context Exposure (covering RAG schemas, hidden policy logic). Improper Output Handling dropped to tenth. According to Deepstrike, this guide is already downloadable from the official site, though the homepage still shows the 2025 content. - **Impact scope**: All teams deploying LLM applications, RAG pipelines, or AI Agents in production. The ranking shifts reflect how the practical attack surface has moved from the "model layer" to the "agent permissions and toolchain layer." - **Defense recommendations**: Immediately review existing threat models against the 2026 list. Prioritize Agent permission scoping and leakage risks from non-user-visible context. - **Source**: Deepstrike（） ### 2. BlueRadius Tests 21 AI Agent Incidents: 100% Bypass Human Review, 70% Involve Prompt Injection, 80% Match the "Deadly Trio" - **What happened**: BlueRadius Research published a report in September analyzing 21 publicly documented cases. Findings: 100% lacked or bypassed human approval, 76% exhibited excessive permissions, 71% involved Prompt Injection (mostly indirect injection), and 81% simultaneously possessed all three elements of injection, outbound tooling, and loose permissions. Per the report, only 19% were confirmed in-the-wild incidents; the rest were vulnerability disclosures or red-team exercises, risk exposure leading actual exploitation. - **Impact scope**: AI Agent systems already live or planned that can autonomously call APIs, execute code, or access production data. Model Context Protocol (MCP) related cases accounted for 29%, showing protocol-layer defenses remain immature. - **Defense recommendations**: Enforce least privilege in Agent identity and permission models, mandate human-approval gates, and deploy indirect injection detection at the input layer. Move authorization and outbound traffic control out of model decision logic. - **Source**: BlueRadius Cyber（） ### 3. Amazon Bedrock AgentCore Compromised via Single Prompt to Steal Metadata Credentials; Mainstream Editor Embedded Browsers Over-Trusted Leading to Host Code Execution - **What happened**: Adversa AI's November 5 resource roundup disclosed that a single prompt against an exposed Bedrock AgentCore could steal metadata service credentials, subsequently taking over all Agents in the same account and region. Embedded browsers in Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop are trusted more than regular browsers, enabling host code execution and cross-disk file reads. Per Adversa AI, TypeSafe's Jev model saw Prompt Injection recall plummet from 83% to below 4% after a forged policy preface. - **Impact scope**: AWS environments using Bedrock AgentCore without metadata access restrictions; engineer workstations using the above editors' embedded browsers for development or testing. - **Defense recommendations**: Immediately audit AgentCore network and IAM policies to block metadata endpoint access. Disable or isolate embedded browser local file and execution permissions in editor settings. Apply zero-trust principles to all embedded web content. - **Source**: Adversa AI（） ### 4. OpenAI Releases GPT-6 Cyber, Autonomous Pipeline Finds 948 Linux Privilege Escalations and 81 Firefox Critical Vulnerabilities, Including Brotli Critical CVE-2026-111497 - **What happened**: OpenAI released GPT-6 Cyber on November 6, classified as Critical under the Preparedness Framework. The model autonomously discovered 948 Linux local privilege escalation vulnerabilities, 81 Firefox critical vulnerabilities, and a critical Brotli library vulnerability CVE-2026-111497 (CVSS 9.2). Official statements indicate a 99.93% probability of staying within scope without deployment safety prompts, and 100% compliance with prompts. Currently available only via API to Daybreak Red customers. - **Impact scope**: Systems running affected Linux kernel versions, Firefox browsers, or the Brotli compression library. Attackers with AI-assisted red-team capabilities may accelerate vulnerability weaponization. - **Defense recommendations**: Prioritize tracking upstream vendor patches. Assess asset exposure for Brotli CVE-2026-111497 and apply mitigations. Incorporate AI-discovered vulnerabilities into patch prioritization. - **Source**: The Hacker News（） ## Closing The one thing to remember from today: OWASP pushed Excessive Agency into the top three, and BlueRadius used 21 empirical cases to nail the "excessive permissions, no human gate, injection exploitable" deadly trio to the wall. Go do one thing first: pull every Agent that can autonomously call tools, scope its permissions to minimum, hang a human approval gate on it, and cut off metadata and embedded browser access. See you tomorrow. --- ## About this article and its author Originally published on [Mark Ku's Tech Notes](https://blog.markkulab.net/en/ai-security/ai-security-2026-11-07) License: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — when reusing or quoting, credit the author and link back to the original ### About the author **[Mark Ku](https://blog.markkulab.net/en/author/mark-ku)** — Software engineer - 10+ years as a software engineer - Built North-American e-commerce and AI SaaS subscription billing ### Free tools built by the author All of these are free to use: - [Free PDF Sign Tool](https://blog.markkulab.net/en/tools/pdf-sign): Online PDF sign tool — draw, type, or upload a signature, then drag, resize, and download. Everything runs in your browser; nothing is uploaded. - [VS Code Refactory](https://blog.markkulab.net/en/tools/refactory): Refactory is a VS Code refactoring extension: 34 actions plus a 37-rule code-smell inspection layer with a Code Health dashboard, across 18 languages, backed by 534 tests. It learns your repo's conventions: where interfaces live, where DI is registered, whether 'use client' belongs. It ranks files by git churn × complexity so you know what to fix first, and hands any smell to the Claude Code already on your machine. Free to use, and your source never leaves your computer. - [DB-Kit Database Manager](https://blog.markkulab.net/en/tools/db-kit): DB-Kit is a lightweight, cross-platform database manager built with Tauri + Rust + React. Manage MySQL, MariaDB, PostgreSQL, SQL Server, Oracle, SQLite, MongoDB, Redis, Kafka, Elasticsearch and RabbitMQ from one consistent interface: passwords encrypted in the OS keychain, SSH tunnels, full CRUD, a visual query builder, stacked multi-statement result sets, cross-connection data transfer, schema & data compare with sync SQL and schema snapshots, Excel / CSV import & export, visualized execution plans, ER diagrams, scheduled backups, SQL stress testing with p50–p99 latency percentiles, a 15-rule SQL review engine, Review & Run (AI review plus per-statement backups and an auto-generated rollback script), Kafka message browsing with monitoring & alerts, an SSH terminal with SFTP / FTP, Docker / Kubernetes, remote desktop (RDP / VNC / RustDesk), file / folder compare, stored procedure integration tests, six UI languages, a built-in AI assistant (a local CLI or any Anthropic / OpenAI-compatible API; natural-language SQL, AI review and tuning advice) and the dbk CLI. Free and open source (MIT), with installers for Windows, macOS and Linux. - [VS Code Super Mermaid](https://blog.markkulab.net/en/tools/super-mermaid): Super Mermaid is a VS Code extension for beautiful Mermaid diagrams out of the box: auto-colored live preview, mouse pan & zoom, high-res PNG / SVG export, 21 templates and multiple themes. Free and open source (MIT). - [React Super Mermaid](https://blog.markkulab.net/en/tools/react-super-mermaid): react-super-mermaid is an open-source React component library: render beautiful Mermaid diagrams with a single , with built-in colorful / sketch themes, pan & zoom, in-diagram search, and high-res SVG / PNG export. Lightweight, SSR-safe, fully typed. Free and open source (MIT). - [Jira / Confluence Super Mermaid](https://blog.markkulab.net/en/tools/jira-super-mermaid): An Atlassian Forge app: write Mermaid syntax directly inside a Jira issue or a Confluence page and get flowcharts, sequence diagrams, state machines and Gantt charts. 11 diagram types, SVG / PNG export, light and dark themes, full CJK support. Runs on Atlassian: your diagrams live in your own site and the app calls no third-party service. Free, coming soon to the Atlassian Marketplace. - [Mermaid Live Preview](https://blog.markkulab.net/en/tools/mermaid-preview): Write Mermaid in your browser, see it render instantly, and share the whole diagram as a single link. No sign-up, nothing uploaded to a server, and mermaid.live share links work as-is. - [React Intl Phone Number](https://blog.markkulab.net/en/tools/react-intl-phone-number): react-intl-phone-number is an open-source React component: framework-agnostic and antd-free, with E.164 in/out, a searchable flag / country-code dropdown, configurable validation levels (strict / mobile-strict / loose), themeable CSS, and i18n — phone logic powered by google-libphonenumber. Lightweight and fully typed. Free and open source (MIT). - [Uptime Kuma Cluster](https://blog.markkulab.net/en/tools/uptime-kuma-cluster): Turn single-node Uptime Kuma into a highly available cluster: OpenResty + Lua smart load balancing, shared MariaDB state, health checks and automatic failover, plus cluster-management REST APIs. One Docker Compose command to start. Free and open source (MIT). - [AI Podcast Cut](https://blog.markkulab.net/en/tools/ai-podcast-cut): Drop in a recording and it removes fillers and stutters, levels loudness segment by segment, and sends a second agent to review every cut. Cut points snap to word boundaries and zero crossings, every splice gets a fade, and sentence-end breaths are preserved. Desktop app for Windows, macOS and Linux. MIT licensed; the Windows installer bundles ffmpeg. - [AI Video Cut](https://blog.markkulab.net/en/tools/ai-video-cut): Pick something in your video: type it (face, license plate, phone screen, logo), click points or drag a box, or let Claude Code / Codex pick it. AI Video Cut tracks it frame by frame, then mosaics or blurs it, recolors it, pins stickers and text to it, swaps a screen or poster for your own image or video, or removes it using background that other frames actually captured. Plus sequence editing, local captions and an AI assistant. Free, open-source (MIT) Windows desktop app (macOS / Linux experimental) that runs locally, nothing uploaded. - [open-pos restaurant POS](https://blog.markkulab.net/en/tools/open-pos): One computer and one receipt printer is enough to open the shop. Your data lives on your own disk, no subscription, no lock-in, MIT licensed. Money is integer New Taiwan dollars with tax split by the statutory formula, so sales + tax always equals the total. Printing goes straight over ESC/POS on TCP 9100, with no vendor driver. Tauri + Rust + SQLite desktop app, v1.0 in development. - [.NET e-commerce API template](https://blog.markkulab.net/en/tools/dotnet-ecommerce-api): An e-commerce backend API template built on .NET 10: Controller → Service → Repository layering, Autofac convention-based registration, SqlSugar for MySQL / MariaDB and SQL Server, Redis cache and message queue, Hangfire jobs, JWT auth, and an extensible payment provider module (ECPay, Newebpay). Apache 2.0. - [Open Token Monitor team AI usage](https://blog.markkulab.net/en/tools/open-token-monitor): Collect token usage and equivalent cost from every employee's AI coding tools into a hub you host yourself: PostgreSQL, org roster, dashboards compared by company and department, and a reports API. Electron and Rust/Tauri clients upload every 30 minutes. MIT licensed, one Docker command. - [ai-security-monitor defensive security](https://blog.markkulab.net/en/tools/ai-security-monitor): Your website is live. Who checks its certificates, security settings and known vulnerabilities? A self-hosted Security Hub brings website scans and host monitoring together, deduplicates findings and compares scans after fixes. ### Daily podcasts - [Mark's Tech Insights — Daily AI News](https://blog.markkulab.net/en/category/tech-news): Daily curated AI and tech trends. Catch the latest developments via audio summaries — covering AI applications, software architecture, DevOps, and engineering practice. — RSS: https://blog.markkulab.net/feed.xml - [AI股市蝦聊](https://blog.markkulab.net/en/category/ai-stock-chat): Every trading day, an AI-analyzed take on the Taiwan stock market, delivered as a two-host conversation covering the session and the next-day outlook. — RSS: https://blog.markkulab.net/ai-stock-chat/feed.xml - [開源好物日報](https://blog.markkulab.net/en/category/open-source-weekly): A daily two-host pick of free open-source tools surfaced from real Hacker News, GitHub, and Reddit buzz — what pain they solve and the fastest way to get started. — RSS: https://blog.markkulab.net/open-source-weekly/feed.xml - [AI 運動日報](https://blog.markkulab.net/en/category/sports-weekly): Two hosts talk NBA, MLB and world sport every day — scores, records and the stories behind them, from a Taiwanese fan perspective. — RSS: https://blog.markkulab.net/sports-weekly/feed.xml - [AI 國際新聞快報](https://blog.markkulab.net/en/category/world-news): A daily two-host briefing that makes sense of the past 24 hours in world news — geopolitics, the global economy, conflict and security, disasters and climate — from a Taiwanese perspective, neutral and fully sourced. — RSS: https://blog.markkulab.net/world-news/feed.xml - [地端 AI 實驗室](https://blog.markkulab.net/en/category/local-ai-lab): Every day, a two-host look at open-weight models and LoRAs you can actually run on your own machine: what they are for, whether your GPU can handle them, and how they compare — sourced from official model cards. — RSS: https://blog.markkulab.net/local-ai-lab/feed.xml - [AI 行銷日報](https://blog.markkulab.net/en/category/ai-marketing): Every day, two hosts break down the latest in AI for marketing, advertising, SEO/GEO and content marketing: practical, never sponsored, every story sourced. — RSS: https://blog.markkulab.net/ai-marketing/feed.xml - [AI 資安日報](https://blog.markkulab.net/en/category/ai-security): Every day, two hosts cover the latest where AI meets cybersecurity: LLM and AI agent vulnerabilities, prompt injection, model supply-chain risks and AI-powered attacks, from a defense-first angle with every story sourced. — RSS: https://blog.markkulab.net/ai-security/feed.xml ### Newsletter [Subscribe to the newsletter](https://blog.markkulab.net/en/subscribe) — Be the first to know about new posts. No spam, unsubscribe anytime.