The Hardest AI Security Problems: What an Agent is Permitted to Do
Excessive agency climbed from sixth to third in the 2026 ranking while improper output handling fell to last place. Europe's 24-hour reporting clock, starting on September 11th, focuses on products rather than deployments.
OWASP’s 2026 Top 10 for Large Language Models (LLM) applications reflects these shifts:
- Excessive agency moved from sixth to third place.
- Improper output handling dropped from fifth to tenth.
As Steve Wilson argues, the hardest AI security problems now lie outside of the models themselves.
Key Takeaways:
-
Excessive Agency: This refers to the permissions and access given to AI agents, not the agent's stated outputs.
-
Improper Output Handling: Concerns how models generate and control their responses.
The 2026 ranking considered both incident data (25%) and practitioner consensus (75%).
Wilson's Recommendations:
-
Use read-only tools instead of general connectors.
-
Ensure requests are made within the user’s scoped identity.
-
Implement a policy enforcement point between the model and downstream systems.
-
Employ human approval for anything difficult to reverse.
Europe's Cyber Resilience Act:
- Requires manufacturers to report actively exploited vulnerabilities within 24 hours (since September 11th).
- Full notifications follow at 72 hours through a designated platform.
- Penalties reach up to €15 million or 2.5% of global turnover.
The Bottleneck:
Not obtaining a bill of materials but trusting one is the main challenge. A list is only as good as the confidence placed in it.
A Mismatch:
The Cyber Resilience Act focuses on products with digital elements, while most AI agents access customers through cloud-delivered software.
Four teams successfully broke AI agents within ten days this summer. The same flaw was present in all cases – it resided in the ecosystem surrounding the model, not the model itself.