OWASP 2026: Excessive Agent Permissions Now Top AI Security Threat

OWASP's 2026 list moved excessive agent permissions from 6th to 3rd in LLM app threats, while improper output handling dropped from 5th to 10th. The ranking is 25% based on 6,639 incidents. From Sept 11, the EU Cyber Resilience Act requires reporting exploited vulnerabilities within 24 hours.

• Excessive agent permissions rose from 6th to 3rd in OWASP 2026 top threats
• Ranking is 25% based on 6,639 recorded incidents
• EU Cyber Resilience Act requires 24-hour vulnerability reporting from Sept 11
• CRA fines reach €15 million or 2.5% of global turnover