OWASP Top 10 for LLMs vs OWASP Top 10 for Agentic AI: What Changed When AI Started Acting

The OWASP Top 10 for LLM Applications tells you how an AI that talks can go wrong. The OWASP Top 10 for Agentic Applications tells you how an AI that acts can go wrong. Once a model can call tools, hold credentials, remember things and hand work to other agents, a bad output stops being a bad answer and becomes a bad action. If you run agents, you need both lists. The agentic list covers risks the LLM list was never built to describe.

This guide compares the two lists entry by entry, shows how the LLM list itself changed in its 2026 edition, and gives you a practical way to secure agents against both.

Why a second list was needed

The LLM Top 10 was written for applications where a model takes input and produces output, such as a chatbot, a summariser or a coding assistant. A human usually sits between the output and anything that matters. Prompt injection there means a model saying something it shouldn't.

Agents remove that human buffer. They plan multi-step tasks, call APIs, run code, read and write memory, and coordinate with other agents. The same prompt injection now means an agent doing something it shouldn't, such as sending data, approving a payment or deleting records, often at machine speed and without anyone watching.

The scale of the shift is why this matters now. Gartner predicts that 33% of enterprise software applications will include agentic AI by 2028, up from less than 1% in 2024, and that at least 15% of day-to-day work decisions will be made autonomously by then. It also predicts more than 40% of agentic AI projects will be cancelled by the end of 2027, with inadequate risk controls among the reasons.

The two lists side by side

The numbers are rankings within each list, not a one-to-one pairing. The mapping below shows how the risks actually relate.

How each LLM risk evolves when the AI starts acting

This mapping is an analytical comparison to help practitioners. OWASP publishes the two lists separately, with cross-references.

What's genuinely new in the agentic list

Three entries have no real counterpart in the LLM Top 10. They exist because agents form systems, not just applications.

Identity also gets far more attention. In the LLM list, permissions sit inside Excessive Agency. The agentic list gives Identity and Privilege Abuse its own entry, because agents often run on shared service accounts or a user's delegated credentials, with no distinct, governed identity of their own.

The LLM list moved too: what changed in 2026

The agentic shift didn't just produce a new list. It reshaped the old one. The 2026 LLM Top 10, published on 3 August 2026, kept the same ten categories but moved eight of them. OWASP based the ranking on practitioner consensus (75%) and 6,639 documented real-world incidents (25%).

Two changes show the agentic influence clearly. Excessive Agency, the risk of an application doing more than it should once a model drives it, jumped to #3. Hidden Context Exposure replaced System Prompt Leakage and now covers retrieved documents, tool definitions, memory and other context the user never sees. The 2026 edition also formally cross-links to the agentic list.

Beyond lists: the Agent Control Standard

Awareness lists tell you what can go wrong. In September 2026, OWASP's GenAI Security Project unveiled the Agent Control Standard, an open specification for governing agents at runtime. It is at version 0.1 and covers core definitions. It aims to make agents inspectable and traceable through guardian-agent enforcement points, observability via OpenTelemetry and OCSF, and an Agent Bill of Materials. Later versions are planned to add enforcement across agent protocols such as MCP and A2A.

Which list should you use?

A 7-step plan to secure agents against both lists

1. Inventory every agent and its powers

   For each agent, record its tools, data access, credentials, memory and which other agents it talks to. You can't limit agency you haven't mapped.

2. Give every agent its own identity

   No shared service accounts and no silently borrowed user credentials. Scope permissions to the task, and make them short-lived where possible.

3. Grant the least agency that works

   Limit the tools, actions and data each agent can reach. Require human approval for irreversible or high-impact actions, such as payments, deletions and external messages.

4. Treat every input as untrusted

   Emails, web pages, documents, tool responses and other agents' messages can all carry injected instructions. Separate data from instructions, and validate before acting.

5. Sandbox code and protect memory

   Run agent-generated code in isolated environments. Validate what enters long-term memory and retrieval stores, and make memory auditable and resettable.

6. Authenticate agent-to-agent traffic

   Sign and verify messages between agents, and set circuit breakers so one agent's failure can't cascade through the system.

7. Log, monitor and keep a kill switch

   Record every tool call and decision with enough context to reconstruct what happened. Watch for drift from intended behaviour, and be able to stop any agent immediately.

Common mistakes to avoid

• Securing agents with only the LLM Top 10
• Running agents on a human user's full permissions
• Trusting tool responses and other agents' outputs as safe input
• Approving agent actions in bulk, so oversight becomes a rubber stamp
• Citing OWASP codes without the year, when 2025 and 2026 numbering differ
• Treating either list as a certifiable standard or a complete control set

A prompt to threat-model your agent

Paste in a description of your agent to get a first-pass threat model against both lists. Use it to start your security review, not to finish it.

You are an AI security engineer familiar with the OWASP Top 10 for
LLM Applications (2026) and the OWASP Top 10 for Agentic Applications
(2026, ASI01-ASI10).

Our agent:
[what it does; model used; tools and APIs it can call; data it can
read and write; credentials it uses; memory or retrieval stores;
whether it runs code; other agents it communicates with; actions it
can take without human approval]

Produce:
1. A table of applicable risks from BOTH lists (cite as LLMxx:2026 or
   ASIxx), with a realistic attack scenario for our agent, likelihood
   (low/medium/high) and impact (low/medium/high).
2. For each high-likelihood or high-impact risk, two concrete
   controls we can implement.
3. A list of actions the agent can take that should require human
   approval, and why.
4. A least-privilege proposal: which tools, data and permissions
   to remove or narrow.
5. The logging we need to reconstruct any agent decision afterwards.
6. Anything you need to know but I did not provide, marked UNKNOWN.

Base the analysis only on what I describe. Do not assume tools or
access I have not listed.

The LLM Top 10 protects you from what an AI might say. The Agentic Top 10 protects you from what an AI might do. Once you give a model tools, you need both. — Kumail Mehdi

Frequently asked questions

Sources

• Giskard — OWASP Top 10 for Agentic Applications 2026
• Imperva — OWASP LLM Top 10 2026: what changed and why
• Cloud Security Alliance — OWASP's 2026 LLM Top 10 and Agent Control Standard
• Modulos — OWASP Top 10 for LLM, 2025 to 2026 mapping
• Gartner — Over 40% of agentic AI projects will be cancelled by end of 2027
• W.Media — Gartner agentic AI predictions summary
• IBM — 2025 Cost of a Data Breach: navigating AI