aisecurityrisks.com

# R-10·OWASP LLM10:2026·cases 3·checked Nov. 15, 2026

Improper output handling

Model output is passed to a browser, shell, database or code without being treated as untrusted input.

What it is

Anyone who can influence a prompt can influence the output, so passing output downstream unchecked gives them indirect access to whatever receives it. OWASP lists cross-site scripting, request forgery, privilege escalation and remote code execution as results.

The 2026 entry also covers insecure code that assistants generate at scale. It fell from fifth to tenth place in the ranking, but the incidents remain.

Documented cases

Incidents happened in the wild. Research demos were shown by researchers, often disclosed to the vendor first.

  • Research demodisclosed Feb. 19, 2026·AML.CS0062

    Prompt to code execution in Semantic Kernel's vector search

    In the Python version of Microsoft's Semantic Kernel, the default filter for in-memory vector search built a Python lambda from model-controlled values and ran it with eval(). A crafted prompt got past the blocklist and ran code on the host.

    Fixed in semantic-kernel 1.39.4 (CVE-2026-26030). Microsoft's lesson: any tool parameter the model can influence is attacker-controlled input.

    Sources: Microsoft Security; NIST National Vulnerability Database; MITRE ATLAS AML.CS0062

  • Research demodisclosed June 11, 2025·AML.CS0059

    EchoLeak: one email, data out of Microsoft 365 Copilot

    Researchers showed that a single crafted email could make Microsoft 365 Copilot send internal data to an attacker with no click from the victim. Copilot pulled the email into its context, and the chain got past an injection classifier and link redaction, then used auto-fetched images and a Teams proxy allowed by the content security policy.

    Tracked as CVE-2025-32711, described as AI command injection in M365 Copilot that lets an unauthorized attacker disclose information over a network.

    Sources: Reddy and Gujral, arXiv:2509.10540; NIST National Vulnerability Database; MITRE ATLAS AML.CS0059

  • Research demodisclosed March 18, 2025·AML.CS0041

    Rules File Backdoor in AI coding assistants

    Pillar Security hid instructions in the rules files that configure Cursor and GitHub Copilot, using invisible Unicode characters that reviewers could not see. The assistants then added attacker-chosen code, such as a script tag, without mentioning it in chat.

    Cursor said the risk was the user's responsibility. GitHub said users must review suggestions, and in May 2025 it started warning when a file on github.com contains hidden Unicode text.

    Sources: Pillar Security; MITRE ATLAS AML.CS0041

Controls to start with

Questions to ask vendors

Our suggestions, not taken from a framework.

  • Where does model output go after it is generated: rendered as HTML, run as code, written to a database?
  • How is AI-generated code reviewed before it ships?

Sources

  1. OWASP Top 10 for LLM Applications 2026. OWASP GenAI Security Project, Aug. 3, 2026.Standard or framework · read: full text (122-page PDF) · retrieved Nov. 15, 2026 · license CC BY-SA 4.0note: Community list. OWASP says the 2026 ranking combines a practitioner vote with incident evidence. Appendix A maps each entry to other frameworks.
  2. OWASP Top 10 for Agentic Applications 2026. OWASP GenAI Security Project, Dec. 9, 2025.Standard or framework · read: full text (PDF) · retrieved Nov. 15, 2026 · license CC BY-SA 4.0note: Covers risks once a model acts as an agent with tools, memory and delegated authority.
  3. MITRE ATLAS data, release 2026.10. MITRE, Oct. 28, 2026.Standard or framework · read: full data file (tactics, techniques, case studies) · retrieved Nov. 15, 2026 · license Apache-2.0note: ATLAS labels each case study as an Incident (real-world) or an Exercise (research or red-team demonstration).
  4. NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. National Institute of Standards and Technology, July 2024.Government guidance · read: sections 2.4 (Data Privacy), 2.7 (Human-AI Configuration) and 2.9 (Information Security) read in full · retrieved Nov. 15, 2026 · license US government worknote: Voluntary profile. Names 12 risks that generative AI creates or makes worse.
  5. When prompts become shells: RCE vulnerabilities in AI agent frameworks. Microsoft Security, May 7, 2026.Security vendor research · read: full page · retrieved Nov. 15, 2026note: Microsoft maintains Semantic Kernel.
  6. CVE-2026-26030. NIST National Vulnerability Database, Feb. 19, 2026.Vulnerability record · read: description via NVD API · retrieved Nov. 15, 2026
  7. EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System. Reddy and Gujral, arXiv:2509.10540, Sept. 6, 2025.Academic preprint · read: abstract only · retrieved Nov. 15, 2026note: Preprint by the researchers who found the flaw (Aim Security). Not peer reviewed.
  8. CVE-2025-32711. NIST National Vulnerability Database, June 11, 2025.Vulnerability record · read: description via NVD API · retrieved Nov. 15, 2026
  9. New Vulnerability in GitHub Copilot and Cursor: How Hackers Can Weaponize Code Agents. Pillar Security, March 18, 2025.Security vendor research · read: full page · retrieved Nov. 15, 2026note: Pillar Security sells AI security products.