What is the difference between the OWASP LLM Top 10 and the OWASP Agentic Top 10?

The OWASP LLM Top 10 focuses on risks that come from model behavior, such as prompt injection and training data poisoning. The Agentic Top 10 focuses on the added risks created when a system can act with tools, credentials, memory, and delegated authority. In practice, the agentic list covers bad outcomes that emerge from autonomy, not just bad model responses.

Why the distinction matters in real deployments

The difference is not academic. The LLM Top 10 is about model-centric failure modes: how prompts, data, and outputs can be manipulated even when the system is mostly a text engine. The Agentic Top 10 starts where that view stops, because once an AI can call tools, retain memory, or operate under delegated authority, the security problem expands from incorrect output to unintended action.

That shift changes what defenders need to watch. A model that merely answers badly can still be contained by content filtering, but an agent with access to tickets, files, APIs, or operational workflows can create real business impact through a single bad decision or a poisoned instruction path. The practical question becomes whether the system can be trusted to act, not only to speak. OWASP’s agentic guidance is aimed at that higher-risk layer, where autonomy turns model weakness into enterprise exposure. In practice, many security teams discover the difference only after an agent has already used a valid tool path in a way nobody anticipated.

For the underlying source guidance, OWASP Top 10 for Agentic Applications 2026 is the clearest external reference for the agent-specific side of that boundary.

How the two Top 10s divide the attack surface

The LLM Top 10 concentrates on weaknesses in the model interaction layer. That includes prompt injection, training data poisoning, insecure output handling, and other ways an attacker can manipulate what the model says or infer from its training and runtime context. Those issues matter even when the model has no direct ability to do anything beyond generate content.

The Agentic Top 10 adds the mechanics that make autonomy dangerous. An agent often has memory, planner logic, connectors, identities, and approval paths. That means the relevant questions are whether it can be tricked into using the wrong tool, whether it can be steered into over-sharing data, whether its credentials are too broad, and whether a malicious instruction can survive across turns or sessions. The attack surface now includes the environment around the model, not just the model itself.

LLM risk: manipulate the response.
Agentic risk: manipulate the action, tool call, or delegated decision.
LLM control focus: prompt hygiene, output validation, data governance.
Agentic control focus: authorization boundaries, tool scoping, memory isolation, and event logging.

That is why the two lists overlap but are not interchangeable. A prompt injection against a chatbot may remain a content problem, while the same technique against an agent can become a workflow compromise. NIST’s AI Risk Management Framework is useful here because it frames both model behavior and downstream system impact, which is exactly where the distinction becomes operational. AI Agents: The New Attack Surface report is also useful reading because it shows how often agent behavior exceeds intended scope in practice. These controls tend to break down when teams assume the model boundary is the same as the system boundary.

Common overlap points and where the comparison breaks down

Tighter agent governance often increases integration and approval overhead, so teams have to balance usability against the risk of delegated execution. That tradeoff matters because some safeguards belong to both lists, but they play different roles depending on whether the system can act.

Prompt injection, data poisoning, and insecure output handling appear in both worlds, but the consequence differs. In the LLM Top 10, the main risk is that the response is wrong, misleading, or unsafe. In the Agentic Top 10, the same weakness can become a trigger for unauthorized actions, credential misuse, or cross-system contamination. Current guidance suggests treating that second case as a higher assurance problem, because autonomy amplifies the blast radius of ordinary model failures.

The comparison also breaks down when people assume all agentic systems are full agents. Some are only lightly automated and may behave more like wrapped assistants than independent actors. In those cases, the agentic risks are still relevant, but the control emphasis should match the actual degree of authority, memory persistence, and tool access rather than the label alone. The best practice is evolving, and there is no universal standard for this yet, which is why practitioners should classify the workload first and the framework second.

CSA MAESTRO agentic AI threat modeling framework is a useful complement when you need to reason about autonomy, tooling, and trust boundaries rather than model behavior alone.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Agentic AI Top 10, CSA MAESTRO and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Agentic AI Top 10	A1 — Agentic Prompt Injection	The question contrasts model-only and agentic risks, where prompt steering becomes action steering.
	A4 — Excessive Agency	Agentic systems differ because delegated authority can turn model errors into real actions.
	A8 — Data and Memory Poisoning	The comparison hinges on persistent memory and state changing the impact of manipulation.
Recommendation — Distinguish tool-enabled attack paths from chat-only prompt risks and harden agent instruction boundaries. Limit delegated authority so autonomous actions stay within explicit, least-privilege bounds. Treat stored context as a security boundary and validate what the agent can remember or reuse.
CSA MAESTRO	GOV-01 — Governance	The distinction is fundamentally about governing autonomous behavior and its blast radius.
Recommendation — Classify which AI systems can act autonomously and assign governance proportional to that authority.
NIST AI RMF	GOVERN — Govern	The question is about managing AI risk across model and system impact, not model output alone.
Recommendation — Set governance rules that cover both model behavior and downstream operational effects.
NIST CSF 2.0	PR.AC — Identity Management, Authentication, and Access Control	Agentic systems become risky when tool access and credentials exceed intended scope.
Recommendation — Restrict agent access paths and verify every non-human credential has a defined scope.
MITRE ATT&CK	T1204 — User Execution	Prompt injection and instruction manipulation often rely on making the target follow attacker-directed content.
Recommendation — Map instruction-following abuse to attacker-controlled execution points in your detections.

Practitioner Guidance

What to prioritise: Decide whether the system can only generate text or can also take actions. If it can call tools, modify records, move data, or use delegated credentials, treat it as an agentic risk problem first and a model-risk problem second.

What to verify: Confirm the actual authority granted to the system, not the authority the design document claims it should have. The important check is whether memory, tool access, and secrets are bounded tightly enough that a bad instruction cannot become an operational event.

Decision rule: If a bad model response could cause embarrassment, it is an LLM governance issue; if it could cause unauthorised access, data movement, or workflow execution, it belongs in the agentic control set as well.

Practitioner takeaway: The critical distinction is whether the system can merely mislead or can also act; once autonomy is present, the security posture must shift from content assurance to action assurance.