On August 3, 2026, OWASP published the first edition of its AI risk list that is based on something stronger than opinion. The new ranking was built from a corpus of 7,714 documented AI incidents, of which 6,639 carried enough detail to be classified. Prompt injection remains the most common attack, and a new entry, excessive agency, has climbed into the top three.
OWASP is the organization that maintains the Top 10 list of web application risks, the closest thing the industry has to a shared safety checklist. Its AI counterpart started in 2023 as expert judgment. The 2026 edition is different. It ranks threats by what actually happened in production systems, not by what security researchers expected to happen. For a small business owner, that shift matters more than any single statistic in the report.
Most coverage of AI security is written for engineers at large companies. The conversation this post is starting is aimed at the business that runs a chatbot, an AI answering service, or an agent that drafts proposals, and that has nobody whose job title contains the word security. The good news is that the risks in the 2026 list are understandable and preventable. The uncomfortable news is that some of them are already in your operation.
The List Is No Longer Opinion
The previous editions were expert judgment. The 2026 edition is a record of what broke in the real world.
The team behind the list worked with public vulnerability databases and an AI harm database to assemble the incident record. Out of the 7,714 incidents analyzed, 6,639 had enough detail to be classified by attack type. That is the difference between a threat model and a report card. When the ranking says prompt injection is the number one risk, it is counting actual cases where an attacker steered an AI system into doing something unintended.
The practical consequence is that AI security has become testable. Your website gets scanned for vulnerabilities because the failure modes of web software are well documented. The same is now true for AI systems. Each entry in the 2026 list comes with a description of how the failure happens, which means each one can be probed for before a customer finds it for you.
The Three Risks That Matter for a Business Your Size
The full list has ten entries. Three of them will decide whether your automation project ends in savings or in an incident.
Prompt injection works by abusing the fact that an AI agent cannot always tell instructions from data. An attacker crafts an input, an email, a support ticket, a webpage, that carries hidden instructions. A support agent reads it and follows the instructions: issue the refund, change the address, reveal order details. The attack does not require technical skill against your company specifically, it targets the model that is publicly known to run your chatbot. It ranks first because every customer-facing AI is reachable through some input channel.
Sensitive information disclosure is the quieter risk. It does not require a malicious actor at all. Cyberhaven’s 2026 report found that 39.7% of AI interactions involve sensitive data, that employees feed sensitive data into AI tools on average once every three days, and that 32.3% of ChatGPT usage happens through personal accounts. The data is not being stolen. It is being handed over. Under GDPR, your obligations as data controller remain in force no matter which tool processed the information, and a model trained on your customer list cannot forget it on request.
Excessive agency is the new entry in the top three, and it is the one that tracks the growth of agentic AI. It describes an agent with more authority than it needs: the assistant that can send emails, edit records, or trigger payments without a human in the loop. The failure mode is not a wrong answer. It is a wrong action taken automatically, at machine speed, across every account it can reach. The more tools an agent can touch, the larger the blast radius of a single misunderstanding.
The same design principles that stop these three risks also make an agent more useful. An agent that can only reach the tools it needs makes fewer mistakes. An agent that asks for approval before an irreversible action builds trust with your team and your customers. We covered the workspace side of this in the post on agentic workspaces: an agent that can see the whole picture needs fewer permissions and causes fewer surprises.
What a Breach Actually Costs
Enterprise breach statistics are abstract. The math that matters to a small business is smaller, more personal, and arrives faster.
IBM’s 2026 Cost of a Data Breach report put the global average cost of a breach at $4.99 million, up 12% year over year and the highest figure ever recorded. The same report found AI-driven attacks up 56% and put the average cost of a model inversion attack, where someone reconstructs the data a model was trained on, at $6 million.
Those numbers describe the Fortune 500. The version that applies to you is different. A leaked client list, a GDPR complaint triggered by a support chatbot repeating one customer’s details to another, a competitor reading your pipeline because an employee pasted it into a public tool. Each of those incidents has a cost that does not show up in IBM’s average: hours of your time, a lawyer’s invoice, a damaged reputation in a small market where everyone knows everyone.
An agent that saves your business €3,000 a month becomes a net loss the day one incident triggers notification duties, legal review, and lost trust. Security is not a cost center in an automation project. It is the difference between the project paying for itself and the project costing more than it ever saved.
Most breaches still trace back to human error and over-broad access. AI adds new channels for the same old failures, which is why the fixes resemble the discipline you already apply to your website, your email, and your bank accounts. The checklist at the end of this post is that discipline, translated for agents.
What the Law Already Expects
Security and compliance are converging. The automation you buy today should be built for rules that arrive tomorrow.
The EU AI Act’s transparency obligations have applied to chatbots and voice agents since August 2, 2026, a timeline we laid out in the post on the August deadline. The heavier security duties sit in Article 15 of the Act, which requires high-risk AI systems to be resilient against data poisoning, adversarial examples, and confidentiality attacks. Those obligations land with the high-risk regime, which for most small businesses arrives in the 2027 to 2028 window depending on the category.
GDPR does not wait for any of that. Your duty to protect customer data applies the moment you collect it, and it applies regardless of whether the tool processing it is an AI agent or a spreadsheet. If anything, AI makes the duty sharper, because the data is moving to systems whose behavior your team does not fully control.
One architectural answer to the whole problem is to keep the data where you can see it. That is the logic behind self-hosted agents like Hermes: when the model and the data live on infrastructure you control, the surface exposed to third parties shrinks dramatically. It is not the only answer, but it is the one with the fewest surprises.
The Security Checklist Before You Automate
Six questions. If an agency or a vendor hesitates on any of them, treat that as your answer.
- Where does the data live? The system should run inside the EU or under a GDPR-compliant processing agreement, and your data must never be used to train a shared model.
- What can the agent reach? Least privilege applies to AI. The agent gets sandboxed access to exactly the tools and records it needs, nothing else.
- Where is the human gate? Refunds, payments, contract terms, anything irreversible, requires a human approval step. No exceptions.
- Was it tested against prompt injection? Malicious inputs are part of the acceptance test, not an afterthought.
- Is everything logged? Every action the agent takes should be traceable to a timestamp and an input, so an incident becomes an investigation, not a mystery.
- Who is responsible when it fails? The contract should name the party that responds to an incident, the response window, and the liability split.
Security is not a layer added at the end of an automation project. It is a property of how the system is built. The good news from the 2026 OWASP list is that the failure modes are now documented, which means they are preventable. The checklist above is the difference between an AI project that saves your business money and one that costs it.
