Prompt Injection Ranks High in OWASP List but Low in Incident Records Due to Detection Gaps

Discrepancy in Prompt Injection Risk Assessment

Kyriakos Lambros and Steve Wilson, leaders of the OWASP Top 10 for LLM Applications project, published an analysis on arXiv revealing a significant difference in how prompt injection is perceived and recorded. While prompt injection has consistently held the top spot on the OWASP Top 10 for LLM Applications for three years, it appears as the 12th most common issue in a dataset of 6,639 real-world incidents.

Invisible Attack Chain

The primary reason for this discrepancy is that prompt injection attacks are invisible to standard vulnerability scanners. The attack involves embedding malicious instructions within content that an LLM processes, such as log entries or support tickets. The LLM then executes actions using its legitimate credentials, without creating a product defect or CVE that a scanner would detect.

Methodology and Findings

The analysis utilized 7,714 LLM security incidents from various sources, including CVE, GitHub Security Advisories, OSV, and the AIAAIC AI-harm database. A Bayesian model was used to correct for classifier error and compare the data-driven ranking with expert judgment. The comparison found no statistically detectable agreement between the two, with a Cohen’s kappa of 0.20, indicating weak agreement.

Implications for LLM Security

This finding suggests that relying solely on incident records or CVE counts may lead to an inaccurate assessment of prompt injection risk. The authors emphasize that neither expert judgment nor incident records alone represent the complete truth. Effective defenses against prompt injection require adversarial testing of deployed systems and strict controls on what an LLM agent can access.