873 bugs, 54 models: notes on the 2026 LLM security report

Figure: The 2026 LLM security report cover from CNCERT (source: cert.org.cn, captured 2026-10-19)

The numbers: 2,467 white hats, 25 vendors, 54 products, 873 vulnerabilities. 608 are LLM-specific; 265 are traditional (30.4%). The report groups them into six risk categories, but the categories are less useful than the three chains behind them.

Six categories, three chains

The six categories are prompt injection, agent identity and permission abuse, goal hijacking, context and memory defects, tool return forgery, and supply chain. In practice they collapse into three chains: data treated as instructions, identity treated as capability, and tool output treated as truth.

Numbers worth quoting

• Prompt injection remains the most common finding.
• One product hardcoded cloud API keys for 239 models in its frontend.
• An agent sandbox had an admin RCE reachable from inside the sandbox.
• 30.4% of findings are ordinary web vulnerabilities — the model is not the only attack surface.

Which recommendations are actionable

The report’s advice is reasonable but generic. The parts that actually change outcomes: separate data from instructions at the architecture level, give agents scoped credentials instead of user credentials, and log every tool call with its arguments.

Reproducing the six categories

You do not need the report’s exact payloads. A prompt-injection test is a document containing an instruction; an identity test is an agent asked to use a tool it should not reach; a tool-forgery test is a mocked response that contradicts the schema.

What the report does not say

It does not rank vendors, and it does not say how many findings were fixed. It also does not address the economics: fixing prompt injection properly often means redesigning the product, not adding a filter.

A 30-minute self-check for solo developers

1. Grep your frontend bundle for keys.
2. List every tool your agent can call and who authorized it.
3. Check whether tool outputs are validated before being fed back.
4. Check whether memory writes are user-controlled.
5. Run one injection payload through your own product.

Using the report

Treat it as a checklist, not a benchmark. The value is in the categories you have not thought about, not in the totals.

My take

The headline is prompt injection, but the real story is that most findings are ordinary security failures wearing an AI costume. Fix the basics first.