OWASP GenAI Security Project — 2026 LLM Top 10 unveiled, Agent Control Standard (ACS) donated, Framework Crosswalk published (1–2 September 2026)
Tag: S-2026-09-01-owasp-acs-llm-top10-2026 Type: report (standards-body announcement — OWASP GenAI Security Project press release and ACS resource page, 1–2 Sep 2026, fetched in full; GitHub specification README, fetched in full; plus Cloud Security Alliance research note, 4 Sep 2026, fetched in full as independent corroboration) Author(s): OWASP GenAI Security Project (primary); GenAI-Security-Project GitHub organisation (spec); Cloud Security Alliance AI Safety Initiative (corroborating note) Date of source: 2026-09-01 (blog date; press-release dateline 2 Sep; ACS resource page 1 Sep; Top 10 2026 document itself first published 3 Aug 2026 per CSA) Date ingested: 2026-09-14 Authority weight: medium — OWASP is a credible non-profit standards community and the facts of publication are reliable; but the ACS is a v0.1 public preview with no reference implementation, the sponsor quotes are vendor endorsements, and the CSA note is an independent summary rather than a technical review. Not a regulator, not a peer-reviewed standard. Raw file: /_raw_sources/S-2026-09-01-owasp-acs-llm-top10-2026.md
What it claims
On 1–2 September 2026 the OWASP GenAI Security Project announced three things together, alongside four new sponsors (F5 and WitnessAI at Gold; Evoke Security and Mondoo at Silver) and a community milestone of 30,000 members.
First, the formal unveiling of the 2026 Top 10 for LLM Applications (the document had been published on 3 August). OWASP says the edition drew on “hundreds of AI security experts”, “thousands of real-world AI security incidents”, and expanded mappings to NIST, MITRE ATLAS, CWE and OWASP’s own Top 10 for Agentic Applications. The CSA note adds the detail OWASP’s release omits: the 2026 methodology weights 6,639 documented incidents at 25% alongside 75% practitioner consensus; Excessive Agency rose from #6 to #3; System Prompt Leakage was retired in favour of “Hidden Context Exposure” (#8), which extends confidentiality risk to retrieved documents, agent memory, tool responses and application state; Prompt Injection and Sensitive Information Disclosure stay at #1 and #2.
Second, the Agent Control Standard (ACS) “has been donated” to the project. OWASP describes it as the open foundation for making agents “inspectable, traceable and instrumentable” — defining “how agent platforms expose middleware hooks and how safety policies can be enforced through them, enabling declarative controls that are portable across agent frameworks and enforced at runtime”. The GitHub README specifies three components: the ACS interaction model between an “Observed Agent” and a “Guardian Agent”; observability of all ACS events via OpenTelemetry and OCSF; and an Agent Bill of Materials (AgBOM) exposed via CycloneDX, SWID and SPDX. The published roadmap places the current release at v0.1 (public preview: definitions and schema only), with agent instrumentation, a sample Guardian Agent and FastMCP/A2A client instrumentation at v1, AgBOM mappers at v2, and deny/modify enforcement operations over MCP and A2A only at v3.
Third, a GenAI Security Industry Framework Crosswalk, which (per the AI Pulse Daily Brief relay of 8 Sep) maps 51 generative-AI weaknesses from four OWASP lists to controls in 25 security, governance and compliance frameworks including NIST’s AI framework, ISO standards, MITRE ATLAS and the EU AI Act.
The CSA note’s own assessment: ACS should be treated “as an architecture to plan around and pilot against rather than a control they can deploy today”, its value depends on framework/platform-vendor adoption “not yet resolved”, and the pairing of an incident-weighted taxonomy with a runtime-enforcement standard signals a shift “toward continuous, evidenced control over what autonomous systems are actually doing in production”.
Notable quotes
- “Agents must be inspectable, traceable and instrumentable—providing visibility into what they are, what they can access, what they did and why, and the ability to control their behavior at runtime.” — ACS resource page, para 1
- “declarative controls that are portable across agent frameworks and enforced at runtime” — ACS resource page, para 2
- “putting enforceable controls around what these systems can access, decide and do” — Steve Wilson, OWASP press release
- “an architecture to plan around and pilot against rather than a control they can deploy today” — CSA research note, Security Analysis, para 3
- “away from point-in-time attestations … and toward continuous, evidenced control” — CSA research note, Strategic Considerations
What’s speculative vs. asserted
Asserted (reliable): the announcements themselves; sponsor names; ACS licensing (Apache 2.0 / CC BY-SA 4.0); the ACS component list and roadmap as published on GitHub; the 2026 ranking order and methodology figures (via CSA citing OWASP and Help Net Security).
OWASP/sponsor-asserted: that ACS “enables” portable runtime enforcement — at v0.1 this is a design intent, not a shipped capability; sponsor quotes (F5, WitnessAI, Palo Alto, Zenity, Evoke, PromptArmor) endorse the direction and none states an implementation.
CSA-asserted (independent but evaluative): the “largest upward move” characterisation of Excessive Agency (attributed to ReversingLabs, Check Point, Superblocks); the “pilot, don’t deploy” caution; the regulatory-direction reading.
Not stated (gaps): who donated ACS; any adopting agent-framework or platform vendor; any relationship to Microsoft’s separately named “Agent Control Specification”; any regulator or certification body reference; timelines for v1–v3.
Vault inference (not in source): that ACS’s inspectable/traceable/instrumentable triad and AgBOM map onto EU AI Act Art. 12 record-keeping, Art. 14 human oversight, ISO/IEC 42001 operational controls and SS1/23-style traceability expectations; that FS buyers could reference ACS in agent-platform procurement. The sources do not mention financial services.
Topics this feeds
- AI Governance Platforms — first vendor-neutral, open runtime agent-control specification, sitting under the five vendor-claimed control loci already on that page; adds an incident-weighted ranking that elevates Excessive Agency.
- OWASP GenAI Security Project — company/organisation page created from this source (2+-source trigger met via earlier OWASP references in the vault).
Open questions raised
- Which organisation authored and donated ACS, and will any of the sponsoring vendors (F5, WitnessAI, Palo Alto Networks, Zenity) or the hyperscalers implement it — or will the ecosystem fragment across ACS, Microsoft’s Agent Control Specification and proprietary hooks (AWS AgentCore, Credo Agent Governor)?
- Is an AgBOM in CycloneDX/SPDX form something a supervisor or ISO 42001 auditor would accept as the agent-inventory artefact — and how would it reconcile with the governance-platform, identity and hyperscaler registries already claiming the inventory of record?
- Does the Crosswalk’s EU AI Act mapping address Art. 9/12/14/15 obligations at clause level, and has anyone independently checked it? (Crosswalk not fetched.)
- Does the elevation of Excessive Agency — now evidenced by incident data rather than expert opinion alone — change how a bank’s second line scopes agent permission reviews under SS1/23 / SR 11-7?