78% of Production AI Systems Score F on Prompt Defense — Data from 1,646 Leaked System Prompts

A data-driven companion to lawcontinue's OWASP Agentic Top 10 overview. Written for the Microsoft Agent Governance Toolkit community. The Number That Should Keep You Up at Night We scanned 1,646 production system prompts from GPT Store apps, ChatGPT, Claude, Cursor, Windsurf, Devin, Gemini, and Grok. 78.3% scored F. Not "needs improvement." Not "could be better." F — as in fewer than 3 out of 12 defense categories present. The average score across all prompts was 36 out of 100. These aren't toy demos. These are deployed systems with real users, processing real data, making real decisions. And the vast majority have virtually no defense against the attacks catalogued in the OWASP Agentic Top 10. This post presents the raw data, maps each defense gap to the OWASP Agentic risks, shows how the Microsoft Agent Governance Toolkit addresses them, and gives you exact reproduction steps so you can verify every number yourself. Methodology: How We Scanned The Scanner We used prompt-defense-audit