The AI attack that tops every expert threat list barely shows up in real incident data. Here is why that gap matters.

Key points

• Prompt injection, the top-ranked AI attack according to the OWASP Top 10 for Large Language Models list, placed only 12th when measured against 6,639 real-world security incidents in a study published on 18 August 2025.
• A statistical test found no meaningful agreement between expert threat rankings and the public incident record, with results so uncertain the two lists could agree purely by chance.
• Prompt injection works by hiding attacker instructions inside content an AI reads, leaving no software flaw a scanner can detect.
• CrowdStrike's 2026 Global Threat Report recorded prompt injection attacks against more than 90 organisations in 2025, stealing credentials and cryptocurrency.
• Two emerging threats, persistent memory poisoning and MCP tool exploitation, sit near the top of the expert list but barely appear in incident data, even as Critical and High-severity security advisories accumulate for both.

The scoreboard looks reassuring. Twelve isn't bad. Problem is, the attack ranked number twelve by incident data is the one security experts unanimously call the most dangerous threat facing AI systems today.

That contradiction is the finding of a new paper by Kyriakos "Rock" Lambros and Steve Wilson, co-leads of the OWASP Top 10 for LLM Applications project, the industry's standard threat-ranking list for large language models, the AI systems that power tools like ChatGPT. They published their analysis on the research repository arXiv on 18 August. It is exploratory work, not peer reviewed, and the authors are clear it does not replace the official OWASP list.

But the numbers are hard to ignore.

What did the researchers actually find?

They measured the same risks two ways: expert judgment (the existing OWASP ranking) and a database of 7,714 real AI security incidents drawn from public sources including CVE, the industry's standard catalogue of software vulnerabilities.

Of those incidents, 6,639 were labelled against a 20-category threat list using a Bayesian model, a statistical method that corrects for classification errors before counting. Then they set the two rankings side by side.

The agreement was almost nonexistent. A statistical measure called Cohen's kappa, which scores agreement between two assessors on a scale where 1.0 means perfect agreement and 0 means pure chance, came in at 0.20. The margin of uncertainty was so wide the true figure could sit below zero.

"Two witnesses are contradicting each other, and we can't tell you which one is lying," Lambros told VentureBeat.

Why doesn't the most dangerous attack leave a paper trail?

Prompt injection is invisible to a scanner because it is not a software bug. It works by hiding attacker instructions inside content an AI agent reads, a log file, a support ticket, a document. The agent treats the hidden text as a legitimate command and carries it out using its own valid access credentials. No defect. No alert. No CVE entry.

CrowdStrike's 2026 Global Threat Report found adversaries used this technique against more than 90 organisations in 2025, stealing credentials and cryptocurrency, in a section the report titled "Prompts are the New Malware."

Wilson, who is also Chief AI and Product Officer at Exabeam, described the defence he would deploy first: a hard gate outside the AI model itself. "The agent can propose the exact DNS change, but it cannot grant itself the authority to make it," he said. Security rules written inside the AI's instructions, he added, are "suggestions to the model, not enforceable security controls."

What about threats that are too new to show up anywhere?

Two entries on the expert list are so recent the incident database can barely place them. Persistent memory poisoning, where an attacker quietly alters what an AI agent remembers across sessions, ranks fourth among experts and sixteenth in the incident data. MCP tool interface exploitation, attacks that hijack the interfaces AI agents use to call external software tools, ranks seventh by expert judgment and also sixteenth in the data.

Threat	Expert rank	Incident rank
Prompt injection	1	12
Misinformation / disinformation	13	2
Persistent memory poisoning	4	16
MCP tool interface exploitation	7	16

Yet public security advisories already exist for both, rated High and Critical severity. One vulnerable agent harness called Ruflo earned a perfect 10.0 Critical score after researchers found it exposed unauthenticated endpoints letting attackers steal API keys and poison the AI's memory store.

Lambros put the budget case plainly. Poisoned memory "doesn't announce itself," he said. An attacker could quietly instruct a procurement AI to approve invoices under a certain amount without a second signature, and no alarm would sound.

Waiting for advisory volume to justify building those defences, Wilson said, means "waiting while the CVEs accumulate at Critical and High."

What should security teams actually do?

Neither researcher treats the incident data as the final word. "It tells us what was observed, recognized, classified, and reported," Wilson said. "It does not necessarily tell us what is most dangerous in the systems people are building right now."

The practical answer is designing AI systems on the assumption that prompt injection will happen, then limiting what an attacker can accomplish when it does. Hard limits on what an agent can access, authorisation gates that sit outside the AI model, and adversarial testing against live systems are the controls both researchers point to.

A low advisory count can mean defences are working. It can also mean nobody has looked yet. The public record cannot tell a security team which.

Common questions

What is prompt injection and should I be worried about it?

Prompt injection is an attack where hidden instructions are buried inside content an AI reads, such as a document or email, tricking the AI into carrying out the attacker's commands instead of its own task. If your organisation uses AI tools that can take actions, such as sending emails, modifying files, or querying databases, the risk is real and worth discussing with your IT or security team.

What is OWASP and why does its list matter?

OWASP, the Open Worldwide Application Security Project, is a non-profit that publishes widely trusted security guidance used by developers and security teams worldwide. Its Top 10 list for large language model applications has become the standard reference for organisations building or buying AI tools.

Is the new research official OWASP guidance?

No. The authors state clearly that the arXiv paper is exploratory, not peer reviewed, and does not replace or supersede the official OWASP Top 10 list or the process that produces it.