Prompt injection ranks No. 1 with OWASP and No. 12 in the incident record. The attack itself is invisible to a scan.

An exploratory arXiv analysis by two OWASP Top 10 for LLM Applications leaders compares expert rankings with 6,639 labeled real-world AI security incidents. It finds prompt injection remains No. 1 in OWASP’s expert list but ranks No. 12 in incident data, likely because these attacks often evade scanners and public reporting.

The gap highlights a growing measurement problem in AI security: public vulnerability records may undercount risks that happen inside model interactions rather than code defects. CISOs relying mainly on CVEs or scanner output could miss LLM-specific threats that require behavioral testing, red teaming, and runtime monitoring.