OWASP Publishes the 2026 LLM Top 10 and an Agent Control Standard for Runtime Governance

The OWASP GenAI Security Project announced on 1 September 2026 a refreshed Top 10 for LLM Applications for 2026 plus a new Agent Control Standard, alongside passing 30,000 community members. The Top 10 refresh is the expected part; the Agent Control Standard is the one worth reading, because it is an attempt to standardise where controls attach rather than to restate what can go wrong. It defines middleware hooks that agent platforms expose at input, output, tool call, tool response, planning transitions, memory operations and lifecycle events, with tool-call authorisation handled at an enforcement layer, so a safety policy can be written once and enforced at runtime across frameworks instead of reimplemented per agent. An accompanying identity workstream covers authenticating agents as non-human actors, with ephemeral credentials and just-in-time access. A separate OWASP project, the candidate Agentic Skills Top 10, covers the skills supply chain specifically and puts malicious skills, supply-chain risk and over-privileged skills in its top three. None of this is an advisory and there is nothing to patch, but it is the first credible common vocabulary for the controls this feed keeps recommending one incident at a time, which makes it useful when a control has to be justified to an auditor or a vendor.

You are affected if you run Not applicable - guidance, not a vulnerability..

Use it as a checklist against controls you already have rather than as a project. The Agent Control Standard's hook points map onto questions worth being able to answer for each agent in your fleet: what sees its input, what authorises a tool call, what records a tool response, what governs memory writes. Where you cannot name the control at one of those points, that is a gap the standard has now given you a shared name for, which is most of its practical value when arguing for a control with a vendor or an auditor. The identity workstream is the part to watch if you are still issuing agents long-lived credentials, since that is the assumption it is designed to retire. Treat the candidate Agentic Skills Top 10 as the companion document if you allow agent skills at all.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Not applicable - guidance and which version, then enforce a policy on it.