OWASP State of Agentic AI Security and Governance 2026: What Changed, and What It Means

When OWASP first published this report in July 2025, agentic AI security was framed as a portfolio of plausible threats. The report surveyed an early ecosystem, mapped likely failure modes, and called for governance to keep up.

A year later, the framing has shifted. The 2026 version is now live, and almost every threat described as plausible in the first paper, now has a CVE, vendor advisory, or production incident attached to it.

I joined the 2026 project and contributed to the Threat Landscape chapter. This post covers what changed in the threat picture, and what changed in the report itself.

Three things 2026 paper says that 2025 did not

1. The threats are operational - The first version reads like a risk assessment of an emerging surface. The 2026 paper reads like a postmortem catalogue. The Threat Analysis chapter places each pattern in the context of where agentic capability was expanding when the break happened, prompt injection scaling through indirect channels, supply chain compromise of MCP servers and skill registries, identity gaps in non-human identity, and sandboxes designed for human operators failing under agent execution. Every section is grounded in documented incidents. The companion Real-World Incidents and Exploits Tracker curates the public record and maps each event to the OWASP Top 10 for Agentic Applications.

2. Safety and security converge at the deployment layer. This is the most consequential framing change in the 2026 paper. Model-level safety remains the provider’s responsibility, but once an agent is acting on production systems, the same controls govern both kinds of harm and the same investigation surfaces both kinds of cause. The Replit production database deletion and the Cursor allowlist bypass have different cause stories: one had no adversary, the other required one, but the permission architecture that produced both is identical. The 2026 paper argues that organizations cannot continue to run AI Safety and AI Security as parallel functions.

3. Governance is being measured in hours. DORA’s four-hour notification, NIS2’s 24-hour early warning, NY RAISE’s 72-hour frontier reporting, and CA SB 53’s 15-day window all assume continuous oversight rather than periodic audit. The 2026 paper covers 42 regulatory instruments across 10 jurisdictions and traces what live monitoring, drift detection, automated incident routing, and agent-speed kill mechanisms actually require to operate.

What’s new in the 2026 paper

• Threat Analysis grounded in documented incidents, with each pattern mapped to the OWASP Top 10 for Agentic Applications
• AI Safety vs AI Security as a standalone chapter on why these categories can no longer be separated operationally
• Real-World Incidents and Exploits Tracker linked to ASI categories
• Enterprise Adoption Maturity Model that assesses governance capability against deployment complexity (AT0 Shadow AI through AT8 Federated)
• Agent Identity / Non-Human Identity elevated to a full chapter treating identity as the new control plane
• AI SBOM and Supply Chain Provenance as a new chapter on what static inventories miss in runtime-composed systems
• Revised Agents Taxonomy across three independent dimensions (type, implementation, composition)
• Ecosystem analysis drawing on telemetry from 53 tracked agentic projects

Where to start

The practical starting point in the 2026 paper is to identify the most advanced agents you are running today, then either raise governance maturity to match or reduce the deployment tier. Shadow AI deserves particular attention: it is present in nearly every organization contributors examined and must be discovered before it can be governed.

Read the full report: OWASP State of Agentic AI Security and Governance 2026

‍