Prompt injection ranks No. 1 with OWASP and No. 12 in the incident record. The attack itself is invisible to a scan.

Prompt injection holds the No. 1 spot on the OWASP Top 10 for LLM Applications for three consecutive years and ranks No. 12 in a corpus of 6,639 labeled real-world incidents. That gap, documented in an arXiv preprint published August 18 by OWASP project leaders Kyriakos Lambros and Steve Wilson, is not a contradiction in findings. It is a measurement problem: prompt injection leaves no CVE because nothing in the attack chain is a product defect. The statistical agreement between expert judgment and the incident record produces a Cohen's kappa of 0.20, with a 90% confidence interval crossing zero. The authors quote themselves directly: 'weak agreement, not confirmation.'

The mechanics and the misinformation inversion are where this paper earns a full read. The incident corpus drew from CVE, GitHub Security Advisories, OSV, and the AIAAIC database, totaling 7,714 incidents run through a Bayesian classifier before ranking. Misinformation sits at expert No. 13 and incident No. 2, the widest divergence in the study, with a 99% probability that the two signals disagree. Two new taxonomy entries, persistent memory poisoning and MCP tool interface exploitation, each land at expert rank 4 and 7 respectively while the incident record places both at No. 16. Public 2026 CVEs already exist for both categories, including an 8.3 High-scored KQL injection in the Azure Data Explorer MCP Server.

The practical output is architectural, not advisory-driven. Wilson, Chief AI and Product Officer at Exabeam, specifies the first control: an authorization gate outside the model so an agent can propose a DNS change but cannot execute it, because security rules written inside prompts are suggestions to the model, not enforceable controls. CrowdStrike's 2026 Global Threat Report logged malicious prompt injections against more than 90 organizations in 2025, framing the attack surface as active and pressured. The preprint is exploratory and not peer reviewed, but the question it forces is the one worth sitting with: a low advisory count can mean defenses are working, or it can mean nobody has looked.