The OWASP LLM Top 10 has a few surprises for you Transcript, AI Summary & Key Points

00:00 The 2026 OWASP top 10 for LLM applications is here. Panel, what stuck out to you about this edition of the list? Seth, we'll start with you. >> Prompt objection still number one, which is no surprise to me, but uh overly permissioned agents jumping way up is something that I think is extremely important and happy to see that it got the credit it deserves.

00:21 >> My takeaway isn't really calling out one thing in particular. But I think what it's looking at for me is how it's able to give us as defenders a common language for AI risk, but I would I warn uh not to treat this as another compliance checklist. Like I I'll probably get into it later, but I would say use it as a tabletop, right? If one of these attacks happened tomorrow, could you detect [music] it?

00:42 Could you contain it? And could you reconstruct what the AI actually did during the attack? [music] Hello and welcome to Security Intelligence, IBM's weekly cyber security podcast, where our expert panelists turn the biggest industry news stories into practical takeaways that you can use. I'm your host, Matt Kazinski, and joining me this week, we've got Seth Glascow, cyber range executive adviser, and we've got Ryan Anuts, North America leader of X-Force Incident Response.

01:10 Today, we're going to be talking about CISA's new guidance on software bills of materials and some highlights from Black Hat 2026. But first, we're going to keep talking about this OWASP top 10. So, this of course is a list of the most critical security risks for LLM powered apps developed by hundreds of AI security experts. Surprising probably no one.

01:36 Prompt injection and sensitive information disclosure were numbers one and two again this year, as they were in the last release. Uh and as Seth uh mentioned in the opening, excessive agency jumped to spot three this time, up three spots from last time, which suggests a kind of newfound appreciation for the ways in which failing to rein in our own models can be a big problem.

01:56 Uh but nobody's here to listen to my takeaways. They're here to listen to your takeaways. So Seth, we'll come back to you on that agent uh front. Talk to me a little bit. What are you thinking about this this increased risk of agentic activity? Why are we looking at it now? What's your take here? I think it's actually a really good viewpoint from everyone to see that these agents are essentially the same as any kind of privileged account might be.

02:17 They take actions, they have access to a ton of stuff. By definition, they have to have access and the ability to interact with and take a lot of different actions automatically for them to be useful, right? So it gets us back to this sort of comprehensive fundamental problem we have with security balancing how functional, how easy, how fast something can be done versus how secure it actually is.

02:40 And so seeing that there's some recognition that it's not necessarily the agent itself, but it's what the agent can do is something that's extremely important, right? It's potentially more in the where seeing where the risk lies with this technology versus something underlying with it. >> And yeah, you know, I feel like we've been heading for this for quite some time.

02:59 I mean, I believe, if I'm correct, I believe you were on the episode we did back in like February that talked about Open Claw, which I feel like was the first big uh agentic, you know, mess news story. And then we've seen recently these these these stories come out about, you know, Open AI's agents got out of the sandbox. Anthropics agents got out of the sandbox.

03:15 This week it was Meta's turn to have agents get out of the sandbox. Everybody's getting a turn getting out of the sandbox. So, it's like the agent. We are seeing for sure just how dangerous uh uh these things can be when they're not treated like an actual identity. You know what I mean? I feel like that's part of the problem here. Ryan, let's let's let's go take a look at your uh take here because I really liked it.

03:34 You know, saying, "Look, this isn't a checklist. It's a common language and and can be kind of the foundation for tabletop exercises." Talk to me about that. >> Yeah, 100%. So, I love how when we structure this list or when we get this list, actually, I think Seth and I were both on one of the last uh podcasts that talked about it, which is which is kind of cool to have full circle for this release, but I love to see how um how risks have or have not evolved.

03:57 And in this case, it's definitely not the latter, right? We are rapidly moving from AI that primarily just generates pure content to you know as Seth alluded to operational agentic systems that you know access your data that use various tool sets um authenticate to other systems and actually I guess the most important thing are actually taking actions.

04:20 So I think we look at what is that what is that real question. The question isn't um can I manipulate what the AI says anymore. The questions becoming can I manipulate what the AI actually does. Um, and I think that's an important point where, you know, we see things like prompt injection or, you know, Seth kind of alluded to it earlier in excessive agency, even though that becoming number third, I think, on the list, right?

04:45 That's becoming much more consequential, right? Well, prompt injection may be the entry point, but agency, look out. Agency, those are the concerns around, you know, determining blast radius, right? Which I think would argue arguably be the most important for defenders. you know what, at least in my opinion, right? [snorts] Um to to your point on the tabletops, what I would do um and I would utilize this like a tabletop if I was um a CISO or you know an an executive in an organization.

05:18 I would look at this list and say, "Hey, let's pick a scenario. You know what what would we would we detect it, right? What would we detect? Could we determine, you know, what the agent accessed and did? Do we have those artifacts in place? Could we even contain the threat? Um, and then, you know, follow on activities, right? Are we reconstructing what the uh what the attack did afterwards or what the agent did afterwards that after that attack.

05:46 So, I think, you know, taking that from an IR perspective, that would be that's really the real test, right? Not just whether you have controls. We talk about identity a lot. I think we're in an identity crisis, but whether you can actually respond when those controls actually fail. But yeah, I really like this idea of using it as the basis for like tabletop exercises, right?

06:04 Because I think especially with lists like this, there's a tendency to just look at it as the checklist, right? To be like, okay, we need to worry about this guy, this guy, this guy, this guy. Knowing about them is only half the battle, as they say, right? Can you actually deal with them? Can you detect them when they're there? So, I really like that as like a framework for making this thing more practicable, you know?

06:25 Um, another interesting thing that OWASP did this time around though, uh, was that in addition to a community vote, they also looked at a corpus of real world incidents and use that information with the community vote to decide where things land on the list. And it was interesting to me that there were some kind of call them discrepancies, right, between what practitioners valued or saw as most important and what the the the databases said was happening out there.

06:51 For for example, prompt injection was the top concern for practitioners. But in terms of incident numbers, it was actually very low. Wasn't even in the top 10. OASP explains it, however, as as basically we're so concerned about prompt injection that we've built so many things to deal with it that those incidents don't make it to the databases, which is very very interesting to me.

07:10 Right. The other side, the other discrepancy that I that was really interesting to me was that practitioners aren't really concerned about misinformation, but the incident numbers suggest they really should be because in especially as we talk about agency and what agents can do, misinformation can very quickly become an agent acting incorrectly, right?

07:28 If an agent gets some misinformation from another LLM or whatever and starts acting on that, it can cause chaos. all of that to to to kind of step back and say, what are your takes on these kinds of differences between practitioner priorities and and what the numbers say? What what do you make of this? Seth, I'll start with you. Any thoughts there? >> I think the prompt injection one is the most glaring, right?

07:49 Everyone says it's number one. We're not having issues with it. I think one, it is the defensive bias, I believe, is what the actual paper calls it. Um, I think another thing to note is that it's an obvious location in a sense because it is the attack surface. It's everywhere. It's anywhere you interact with it. It's anywhere any user could interact with it.

08:08 And so we are going to build more defenses there because it's a very easy use case to understand. So it's easier to kind of build up and sort of prevent this because I have to be cognizant of it. I'm surrounded by it as sort of my attack surface. Misinformation on the other hand is a little bit harder to detect. It's a little bit harder to prevent against.

08:27 You have to kind of prevent for model drift. This could happen over a much longer period of time. It might not be something as acute as you might notice with prompt injection. So it makes sense that if something is agentic and it's taking wrong information and then it's making these mistakes sort of in perpetuity at a much higher speed than someone used to be, the combination of those becomes much more impactful even though we don't necessarily think about it as attack surface.

08:54 Right? The training data for what my agent's going to do is sort of located deep within the center of my model. In theory, it has a lot less attack surface. So, as a defender, I completely understand why we don't prioritize that as much. It's a lot harder to detect as well. >> Perfect sense to me. Absolutely. It it's it's not right there at the top of the attack surface like you said, and you can't even necessarily see it all the time.

09:16 Um Ryan, anything to add there either, you know, to what Seth said or or or just thoughts on the discrepancies in general? >> Yeah, no, I completely agree with what Seth said, you know, and to kind of take that one step further when you look at the misinformation. Um, I think that's a very interesting one because I think that could be multiaceted, right?

09:30 That could be misinformation that's intentional and unintentional. And I think from an attack perspective, I'm going to allude to one in my my later um in my later Blackhot um you know kind of debrief, but there's some information techniques that threat actors are using that I think can maybe make the m make the waters even more muddy uh with these attacks and kind of how we prioritize and what we should prioritize from a a boots on the ground type response.

09:57 Well, interesting too with misinformation. As users, we're kind of conditioned at this point to expect some sort of hallucination or misinformation coming through our generative AI, right? So, because of that, we might turn a little bit of a blind eye to where it's having an impact. Right? If I'm expecting X percentage of the input to not be good, I am more likely to ignore signs of this type of poisoning because I am conditioned to be used to the fact that it might not always be right.

10:25 And that drift can happen much easily over time because I'm simply not attuned for it. I'm not expecting accuracy. >> I didn't even think about that. But that it's like a perfect storm there. You're not expecting accuracy. And then Ryan, you alluded to like these misinformation techniques. I that makes me feel bad. But [laughter] to uh last kind of question here for this segment though, folks, before we close out, I wanted to ask about something that's it's right up top.

10:49 It's right in the introduction uh uh to this this list, but I just found it so interesting. I want to get your takes on it. The the project leads kind of sum up their major takeaway from the list by saying this. Stop trying to build a model that cannot be fooled. Build the system around it so that when the model is fooled and it will be nothing important breaks.

11:07 Uh Ryan, any thoughts on that take? You think that's the right way to approach this? >> Yeah, well I mean I think to me what they just said was, hey, everyone needs to practice cyber resilience, right? That's what we talk about defense in depth. We talk about cyber resiliency. That is what they are saying. just not in those words. Um, so that is a a common theme I think that we're seeing that now even in our services that we that we give to clients, it's just inherently built in from a resilience perspective.

11:34 So, um, completely agree with that. Right. >> Yeah. I mean, it's really kind of what we preach at the cyber range as well is that it's not if, it's when you experience some sort of breach. And we are now being a little more honest about that in terms of how it comes into AI. There is no system that has users and is useful that is entirely secure. Right?

11:55 So we have to be ready. We have to be prepared to respond to that because largely how an organization comes through a breach is about how they responded, not the fact that something happened initially. It's because they didn't respond well or were unable to recover. So we have to just sort of take table stakes as yeah, we are going to have to respond to problems with this.

12:13 So we need to be honest about it and sort of work towards that. Yeah, I really like that take, too, because, you know, I think sometimes there can be this thought that like if we can't secure AI or if AI has all of these flaws in it, then like how can we possibly use it? Everything's got flaws in it if we're going to be honest with ourselves, right?

12:28 That's the whole reason cyber security exists as a discipline because someone needs to be there to help deal with the flaws and respond. Um, folks, before we we close out this segment, I just want to, you know, the viewers and and and the listeners, anybody watching on YouTube, if you've got thoughts on the the newest OASP top 10 for LLMs, drop them in the comments.

12:45 I do read. I do respond. I'd love to hear from you. But to move us to our next topic here, we've got CISA's new SBOM guidance. So CISA along with a handful of international partners released new guidance called the 2026 minimum elements for an SBOM replacing the 2021 standard. Now, in the words of Dark Readings Nate Nelson, who wrote a really good uh kind of, you know, summary of this, and I encourage listeners to go read that.

13:12 Uh there's nothing revolutionary about the changes, but there are some things worth noting. Particularly, one of the fields has changed from a depth requirement to a coverage requirement. Basically, they're asking you to record not just dependencies, but dependencies of dependencies of dependencies of dependencies. Um, folks aren't sure just how helpful these new guidelines really are.

13:32 Speaking to Nelson at Dark Reading, OWASP founder, look, it's OWASP again. OWAP founder Jeff Williams says, quote, "The real measure of success isn't how completely we catalog the problem. It's how effectively we reduced the actual risk." I want to start there, folks, with with the with Williams' take here that that cataloging the problem isn't really the issue.

13:51 It's how effectively we we we deal with the risk. And Ryan, I I'll start there. What do you think about that take? >> So, I mean, I guess kind of rewinding. I am a fan I will say this before I I preface. I am a fan of esbombs, right? But to his point and what he's pointing out here, having an ingredients list doesn't automatically make a meal safe, right?

14:12 It's what we do or what we or what our person or our organization is that you know is going to be consuming that, right? The improved visibility I think into dependencies is absolutely valuable because modern software supply chains are probably an an understatement of being incredibly deep, right? The vulnerable component might be three or four days or or layers down in something that like you've never knowingly installed and that is layers and layers deep.

14:42 Again, could be days in between you knowing you even installed it. But I think we really need to move from an SSBOM generalization to an SSBOM opera operationalization. Um, and that's a again a similar theme I think from the OASP list, right? We just don't want to take this at face value. We want to take it and make it something that we can operationalize within our organization.

15:06 I would say that if a critical vulnerability drops on a Friday night, which naturally don't they always happen on a Friday, um I I don't want one of my team members going and searching SharePoint to for a spreadsheet, right? Like to look at what the what the sbomber could be impacted or if I'm better yet, if I'm a CISO, I want to immediately know, hey, do we have that?

15:29 Where the heck is it? Is it exposed? Is it exploitable? and what or where critical business uh systems could be impacted or affected. I think that's really where ESBOM becomes a more of a security capability instead of, you know, a simple checklist or a compliance artifact. I think, you know, the inventory tells me what I have, but more importantly, context tells me what I need to care about first.

15:56 And I think that's ultimately that's ultimately where organizations should be trying to get to. Yeah, I really like that take. You're right. There is uh it's very very similar to the OASP list and I didn't really think about that when I put these together, but like both of those are things where there's a risk where you just look at the list or you look at the sbomb and you say I'm done.

16:14 I looked at the thing that I did the work. That's just the preparation for the work, right? Like that is not the the the end point. And and I do think, you know, as much as we sbombs are extremely important to our kind kind of contemporary approaches to cyber security, but we need to remember that they are just the beginning of that approach. Um Seth, how about you?

16:36 Anything to add there? Any thoughts here? >> Yeah, I actually think that's a really good way to look at it though in the way that Ryan was sort of talking about sort of operationalizing these things, right? Getting the data is great. It's great to have all of this, but for it to be functional beyond just this inventory, we have to figure out a way to make use of the data to both make real-time decisions where we're trying to respond to something, but also manage our risk overall.

16:57 So, for example, the changes that are forcing us to now document all of the inherited uh dependencies as well, that's good objectively, but there's no real guidance around that. We need to think about well is there a layer or a level of once you're so many steps down should you start to consider that overall risk right how do we operationalize these pieces of data so that they have sort of a use right because currently the sbomb's great we do want to document all this but without regulation forcing it without some sort

17:27 of tangible use it becomes overhead right so ideally what we need to do is find a good use case for the sbombs so that their creation their maintenance and participating in the process is sort of its own reward versus having to just be forced into documenting it a minimum amount of times, right? How do we operationalize this data so that it's not viewed as overhead, but it's actually viewed as something we can internalize and throw into a security operations workflow?

17:57 That way, we're more likely to get more folks participating and better data. Just filling it out isn't enough. You actually have to make use of it to know that it was reliable in some way. Otherwise, it's just a check the box compliance artifact. >> I think you're right. Like the question is how do we operationalize? And so I do kind of want to throw that at both of you.

18:14 Any thought if somebody's listening here and they're like this is great. I agree with this. How do I start operationalizing this kind of stuff? Uh uh Ryan, any thoughts there like where do you begin? >> Maybe a first step would be really connecting esbombs to your vulnerability or exposure management program, right? Your threat intelligence program.

18:30 Um and I think then adding the business context, right? like don't just tell me that vulnerable component exists. Tell me where it is, whether it's exploitable and what should I need to prioritize first in my organization. I think that's where you can truly operationalize um on the forefront of of an ESBO. >> Yeah, I agree. You definitely want to integrate that with your vulnerability management.

18:54 Is it on the internet? What else can we do with it? I also think we could kind of look at it from an internal development perspective. Hey, when I have IT teams developing tools, developing software, do I use this as more of a risk guidance on hey, we're not we are choosing not to use this library because as we look through these documents, we can see that there are a ton of inherited things that overall increases our risk posture, right?

19:16 I think these documents can be very good at the strategic level of security planning in terms of the types of things you want to bring into your organization and what makes sense, right? potentially by using them at that more strategic level, we can then find where the data points really plug in at lower levels to make this a more uh required not required but more desired tool by folks to get access to this data to do something with it.

19:42 >> I love that cuz you you folks together kind of it you you hit the whole spread, right? Seth, you're talking about using it to design secure software. Ryan, you're talking about using it to inevitably catch some of the flaws that pop up in the software we design. It's like end to end. I love that. Um, let's move along here to our final story uh uh for this week.

20:00 This is Black Hat 2026. Highlights is of course one of the biggest cyber security conferences of the year just wrapped up. So, we got to talk about it. And uh Ryan, I know you were there. So, we will start by asking you what did you see? What are your takeaways? What are you thinking about? >> You know, it's in Las Vegas, so you're always seeing a lot.

20:21 You're always learning a lot, right? I think there's always huge takeaways from Black Hat. more importantly, you know, the hacker hacker summer camp week between black hat and defcon. Um, I think you see a lot of interesting developments between the stuff that is acknowledged this week or disclosed this week versus what was done earlier at RSAC conference, right?

20:44 Or RSA um earlier in the year to see the advancements from that time to now, which is a very very short time um I think is a huge takeaway. Um, and I I guess I I'll dive into that a little bit, right? You see a lot around AI agents and the talk of AI agents started earlier late last year, earlier this year where it started becoming the norm. And if you, you know, at RSA or even at Black Hat, if you're walking around, hopefully you're not playing a drinking game with your buddies in Las Vegas where every time you see AI

21:13 agent, you take a shot, that would not be a good game to play because it is simply everywhere. But the takeaway from that is AI agents themselves are actually becoming the attack surface. If you really look at what we're doing, we're actually creating a new attack surface and that is AI agents, right? We're moving beyond exploiting software vulnerabilities to actually manipulating the AI decisionmaking and most importantly the authority we have actually given these systems is really what we're exploiting and what we're

21:49 um [snorts] and what we're working with here right I think a prime example of this um there was a very important briefing where um you know my team was some of some people from my team were very lucky to to join this and we and we talked about this um where there were researchers that were re involved around researching agentic browsers and that team demonstrated how something as simple as a malicious calendar invite could actually manipulate an already authenticated agent and ultimately lead to credential theft, data

22:26 xfill, persistence, and even code execution on that on that user's endstage. I think really what what stuck to me um when I heard this this story or this briefing was their concept around intent collusion. And this is where I bring it back to the very initial initial um comment that I made about black hat intent collusion. And I know that is a super fancy word for me.

22:52 But um this is this is this is why it is though, right? It is essentially persuading the agent that what the attacker wants is actually the best way to accomplish what the user wants. That's kind of that's a kind of mind-blowing experience right there. Right. And I'd say, you know, in in past podcasts, we've talked about the social engineering in AI world.

23:18 Well, here you go. We are actually operationalizing it in the machine world, right? Um, I think that that team also had a really cool security takeaway from their research that I would argue is equally important uh to that vulnerability or exploit or whatever you want to call it itself. Um, but the controls that worked were actually the ones that AI never got a deciding vote in, right?

23:43 It was least privilege, it was segmentation, it was hard boundaries. All of those things that we talk about, identity, those are the things that um I think are equally important um from a defender's perspective, right? I think from in an I in IR, obviously I'm biased towards IR, but that's the challenge, right? the a the agent might be using um legit creds um and approved tools that you've used frequently on your machine, but it's acting completely against the user's intent without the user ever being the wiser.

24:18 So I I mean I think if you look at like you know we're not just hunting compromised endpoints anymore. Uh those days have come and gone, right? Maybe they still are around but those those are going to be the past, right? We have to understand that when a trusted autonomous system has effectively become the threat itself um yeah it just really it just strengthens where you know I say we're in an identity crisis right it all kind of comes back to how our how our identity practices are and that's a mindset and uh thing

24:50 I've been kind of preaching for a while so those are just some of my key takeaways of of what I saw >> that's a really fascinating the the attempt collusion is really fascinating to me because I think you think of like a a classic prompt injection is like, oh, you trick the AI into doing something different, but here it's you trick the AI into thinking it's doing what it user told it to do just through what the attackers want it to do, right?

25:12 Like it's it's like a it's like a meta prompt injection in a way. And and yeah, that that's very interesting, very scary to me. Um [laughter] >> interesting and awesome and scary at the same time, right? What a what a time to be alive. the trifecta >> like like so many things in cyber security today are interesting, awesome, and scary. Uh Seth, Seth, I know that you weren't at Black Hat this year, but any thoughts just hearing Ryan kind of talk about his takeaways?

25:37 >> Yeah, I mean it kind of matches up with what we saw with the OASP as well in terms of looking at agents as this new attack surface, this new item, right? They have too much agency. They're going to do things. So, it is that kind of a problem and there there's no real way around it, right? I think that the writeup also sort of said that not one single control was more than 31% deployed across any organization.

25:58 So we haven't even really come to a solid way to take care of these things. Uh 80% had already been hit by a AI related security incident or something along those lines. And it just starts to think we have to relook at the way we're doing this. The AI itself, right, an LLM can't differentiate between instructions and data. It's all just trying to satisfy what its users asked it to do.

26:20 And that's why it takes when it's agentic and has the access to, it will take actions that look absolutely wild because it is attempting to satisfy that, right? Um, it is able to get you the right answer without not necessarily knowing what it was telling you, right? Similar to highle Scrabble champions can win Scrabble tournaments in a language they do not speak because they know how to get the right answer without necessarily understanding what that word is sort of a sense there but when you combine the fact that the

26:50 agents themselves have a lot of access they can do a lot of things very very quickly meaning if I get one user's credentials and I'm sort of working through that that takes a certain amount of time once I turn an agentic solution it can operate extremely quickly so the amount amount of time and the dwell time it takes effectively to exploit something shrinks as well.

27:11 So the lack of controls around that are really what's kind of horrifying and that we've been very good at implementing this stuff, but we're trying to build security back on now because we've realized similar to a lot of, you know, what I'll call traditional cyber security. Some of the weakest parts are the human side, what you can socially engineer.

27:28 uh an individual with access is 10 times more dangerous than uh anything else externally that I don't have access to. >> This concept that's really developed throughout this entire episode and I love when this happens organically is that it's it's like Ryan, you put it best, we are kind of in an identity crisis moment, right, when it comes to these agents and like how do we control them?

27:50 How do we give them access controls? How do we treat them like the identities that they are? Because they're not just your typical app. These things act like a weird blend between a human and a and and a and a and a piece of software, right? And it keeps I have cost of the data breach uh on the brain because it just came out a couple weeks ago and it keeps making me think of this one stat that was like frankly horrifying to me which was that uh of organizations that dealt with an AI related breach.

28:16 92% of them 92% of them said they did not have proper access controls on their AI implementations. Right. And so it goes back to what you just said, Seth, which is that like we've been in this rush to get these things in there, get them implemented. Maybe we weren't thinking at the time about how we do that securely, and now it's a moment of, oh boy, we've got a lot we need to secure.

28:36 But folks, that does it for this episode. I want to thank our panelists, Ryan and Seth. I want to thank the viewers and the listeners. I want to thank our producers. Subscribe to Security Intelligence wherever podcasts are found so that you never miss an episode. Stay safe out there and uh keep an eye on your agents and especially your calendar invites. >> [music]