What is the difference between the OWASP LLM Top 10 and the OWASP Agentic Top 10?

How the two OWASP lists split the problem space

The difference is mostly about where the risk originates. The LLM Top 10 is about failures in model output, instruction handling, and training or retrieval quality. The Agentic Top 10 starts where the system is allowed to take actions, so the question is not only “what did the model say?” but “what did the system do with that output?”

That shift changes the security boundary. A chat model can mislead, leak, or be manipulated, but an agent can also call tools, move data, trigger workflows, and compound a small error into an operational event. In other words, the agentic list adds authority and execution to the threat model.

For a deeper map of the LLM side, see OWASP Top 10 for LLM Applications Guide, which traces the classic LLM failure modes and how they are tested in practice.

Why tool use, credentials, and delegated authority change the risk model

An LLM risk may stay inside the response channel. An agentic risk often crosses into external systems, because the model can operate with tool access, API permissions, session state, or delegated authority. That makes privilege, scope, and containment central to the analysis, not just model robustness.

This is why the agentic list is not just “LLM risks plus automation.” Autonomy creates new failure modes such as tool misuse, unintended side effects, multi-step abuse chains, and actions taken on behalf of a user or organisation without the right checks. The impact can be broader even when the model itself is not especially wrong.

OWASP’s agentic guidance reflects that change in attack surface, and the Agentic AI Security Guide is useful here because it separates inputs, memory, tools, orchestration, and identity into distinct control points.

What practitioners should compare when choosing between the two

Start with the system architecture, not the label. If the product only generates text or recommendations, the LLM list is usually the better fit. If it can invoke tools, write to systems, approve actions, or act across sessions, the agentic list becomes the more accurate lens because the main question is now about control of action, not just control of output.

That distinction matters during design reviews and threat modelling. A team can have a relatively ordinary LLM exposure but still create a high-impact agentic exposure by wiring the model into email, code deployment, ticketing, payments, or internal data operations. The risk grows when actions are persistent, hard to observe, or difficult to roll back.

For a practical comparison of where those boundaries shift, the AI Agents vs Agentic AI guide helps separate simple assistant behaviour from systems that can actually exercise delegated control.

Risk and Threat Considerations

The main risk difference is blast radius. A compromised or manipulated LLM may produce harmful content, but a compromised agent can execute that content through tools, credentials, and workflows. That turns prompt injection, hallucination, or poisoned context into a path for real-world abuse, persistence, or lateral movement.

Failure mechanism: The agent trusts an instruction, memory item, tool response, or user context that should have been treated as untrusted, then uses legitimate permissions to carry out an action outside the intended scope.

Impact: The system can leak data, alter records, trigger downstream systems, or perform actions that look authorized because they were executed through a valid identity and tool path.

Practitioner Guidance

What to verify: Decide whether the system is only generating output or is also allowed to act. If it can act, verify the full path from model output to tool execution, including approval gates, scope limits, and revocation points.

Decision rule: Treat any agent with standing access, reusable credentials, or broad delegated authority as materially more sensitive than a non-acting LLM, even if the model quality is the same. The governance question is not “is the model safe enough?” but “is the action boundary tight enough?”

Practitioner takeaway: The key difference is not model intelligence, it is operational authority. Once a system can act on behalf of a user or organisation, the control problem shifts from prompt safety to privilege, containment, and accountable execution.

Related resources from NHI Mgmt Group

• OWASP Agentic Top 10
• OWASP LLM Top 10
• What are the core risks identified by the OWASP Agentic Top 10?
• How should security teams map the OWASP Top 10 for Agentic Applications into existing control frameworks and threat models?