Prompt Injection: A Structural Problem Undetectable by Vulnerability Scanning

Prompt injection has ranked first for three consecutive years in OWASP's "Top10 for LLM Applications," a critical benchmark for AI security. Yet when compared against publicly recorded incident data, the same attack ranks only 12th. This significant discrepancy points to a fundamental challenge in security management for the AI era.

This analysis was presented by Kyriakos "Rock" Lambros and Steve Wilson, co-leaders of the OWASP LLM Applications Top10 project. In a paper released on arXiv on August 18, 2025, the authors analyzed 7,714 LLM security incidents collected from CVE (Common Vulnerabilities and Exposures), GitHub Security Advisories, OSV, and the AIAIC AI Harm database. Of these, 6,639 incidents were classified into a 20-category taxonomy to compare expert assessments with actual incident records. The authors note that this paper has not undergone peer review and does not represent OWASP's official position.

The analysis found no statistically significant agreement between expert evaluation and publicly recorded incidents. Cohen's kappa, which measures the degree of agreement, was 0.20, with a 90% confidence interval ranging from negative 0.16 to 0.57. Because the interval spans zero, the authors state that alignment between the two rankings cannot be said to exceed chance. Lambros described the finding as "two witnesses giving contradictory testimony, with no way to determine which is correct."

Why does prompt injection remain underrepresented in incident records? The answer lies in the attack mechanism itself. Prompt injection occurs when an attacker embeds malicious instructions into content that an AI model reads—log entries, support tickets, retrieved documents, and so forth. The AI agent mistakes these for legitimate instructions and executes the attacker's intended action within the scope of its own authority. This entire sequence involves no software vulnerability, so it is never recorded as a CVE and remains invisible to vulnerability scanners.

Traditional security management assumes that low CVE counts indicate low risk. Prompt injection, however, undermines that assumption. Operating outside the reach of vulnerability scanners, it creates a situation where zero CVEs do not guarantee safety. As AI agents increasingly reference external data and invoke tools, this attack surface expands accordingly.

The paper proposes two directions for defense. First, conduct attack-simulation testing against live systems. Second, strictly limit the scope of resources and tools accessible to AI agents at the architecture level. The underlying reasoning is that early work on agent memory management and MCP (Model Context Protocol) tool boundaries is essential to address the problem structurally, rather than waiting until incidents accumulate.

The most significant insight from this research is that the perception of "what is dangerous" can shift depending on measurement method. The misalignment between expert-curated lists and actual incident data serves as a caution against relying on only one approach to security planning. As AI systems become more prevalent, the industry faces a pressing question: how do we make visible the risks that scanning cannot detect? The development of such methodologies now emerges as a central issue for AI security standardization.