Prompt Injection Leads OWASP LLM Top 10 but Ranks 12th in Real‑World Incidents – Scanners Can’t See It

Prompt injection remains the leading threat in the OWASP Top 10 for LLM applications, yet a new analysis of 6,639 real‑world incidents places it at rank 12, revealing a gap that traditional vulnerability scanners cannot bridge.

Prompt Injection: OWASP’s #1 Yet Incident Records Show #12

Kyriakos “Rock” Lambros and Steve Wilson compiled 7,714 LLM‑related security events from CVE, GitHub Advisories, OSV and the AIAAIC AI‑harm database, then applied a Bayesian correction to rank risks. Their arXiv pre‑print, posted August 18, stresses the study is exploratory, not a formal OWASP release.

Why Scanners Miss the Attack Chain

The attack hides malicious instructions inside ordinary content – logs, support tickets or retrieved documents – prompting the model to act with legitimate credentials. No code defect surfaces, so CVE‑based scanners see nothing.

“We had two ways of measuring the same risk, expert judgment and the public incident record, and they disagree,” Lambros told Reuters.

Must Read Intel Review our latest briefing on this sector

Related Intel: Ad Tracking Service DecryptAds Uncovers Who’s Watching You Online

Defenses therefore rely on adversarial testing and strict authorization gates. Exabeam’s chief AI officer Steve Wilson proposes an external gate that lets an agent propose a DNS change but blocks autonomous execution, trading full autonomy for bounded remediation.

The incident tally shows ↑ 90 organizations hit by prompt‑injection attacks in 2025, according to Bloomberg, yet the rank‑12 placement reflects only the attacks that breached detection.

Misinformation, another top concern, sits at #13 in expert votes but #2 in incident data, highlighting the widest disagreement between the two “witnesses.”

Emerging categories such as persistent memory poisoning and MCP tool interface exploitation suffer from sparse records; existing CVEs rate as ↓ 12 in severity compared with critical flaws, urging organizations to embed safeguards early.

Practitioners are advised to treat the OWASP LLM Top 10 as a coverage map, not a strict priority list. Log every prompt, response, retrieved document and tool call, and monitor model confidence scores – a poisoned instruction often returns high certainty.