OWASP Now Has Two AI Top 10s: What Changed?

In 2023, when OWASP introduced the Top 10 for LLM Applications, it was exactly what the industry needed. Suddenly we had a common language for AI risk.

• Prompt injection
• Sensitive information disclosure
• Insecure output handling
• Training data poisoning
• Overreliance on model output

These weren’t abstract fears anymore — they were categorized, named, and made actionable.

At the time, most “AI applications” were exactly that: applications wrapped around a large language model. These included a chat interface, a summarizer, a content generator, and maybe a retrieval pipeline bolted on. The model generated text. A human read it. The blast radius was mostly informational. The LLM Top 10 was built for that world, but we don’t live in that world anymore.

The OWASP Framework for Agentic Applications

In December 2025, OWASP released a second framework: the Top 10 for Agentic Applications (2026). It didn’t merge it into the LLM list or just add a few new categories. They created a separate document entirely. That decision is the point: the LLM Top 10 secures the model layer, and the Agentic Top 10 secures the execution layer. They are different things.

The LLM Top 10 is concerned with the integrity of reasoning. Can the model be manipulated through prompt injection? Can it leak secrets through generation? Can it produce output that downstream systems mishandle? Can we over-trust what it says? These are real risks, and they haven’t gone away. Every agent still contains an LLM. Every autonomous system still inherits those vulnerabilities.

An agent, however, is not just a model that talks. An agent plans, calls tools, and reads and writes data. It uses credentials, persists memory, executes workflows, and it operates across systems. In this scenario, when output becomes action, the threat model expands.

Prompt injection is a perfect illustration. In a basic LLM application, prompt injection might cause the model to produce harmful or misleading text. That’s serious but bounded. In an agentic system, prompt injection can redirect a workflow, trigger unauthorized API calls, exfiltrate data through tool usage, or persist malicious instructions into memory for future tasks. The root vulnerability is the same, but the consequences aren’t.

The LLM Top 10 was written for systems where output was the end of the chain. The Agentic Top 10 exists because output is now the beginning of one. Authority is the dividing line. A standalone LLM does not have authority. It generates suggestions. An agent often runs with service accounts, API keys, database access, internal system permissions. If it is compromised, the attacker doesn’t just get text. They inherit delegated power.

The New Problem: Identity, Access Control and Runtime Enforcement

That is no longer a model security problem. That is an identity, access control, and runtime enforcement problem, driven by a probabilistic decision engine.

Persistence is another fault line. Traditional LLM interactions are largely stateless. Agentic systems maintain memory across steps and sessions. They store context, retrieve documents, and accumulate state. That creates new risks: memory poisoning, cross-session contamination, durable malicious goals, to name a few. These aren’t neatly captured by model-centric categories because they emerge from long-lived execution, not single prompt-response interactions. Time itself becomes an attack surface. The LLM Top 10 largely evaluates discrete interactions. Agentic systems operate over hours, days, sometimes continuously. They retry tasks and escalate when blocked. They chain decisions. Security can’t just inspect inputs and outputs anymore. It must monitor behavior across sequences of actions.

The Two OWASP Frameworks are Necessary

If you’re building a chatbot that generates summaries, the LLM Top 10 may be enough. You’ll focus on prompt injection defenses, output filtering, data handling controls, supply chain scrutiny. That’s appropriate.

If you’re deploying an AI system that can send emails, move money, modify infrastructure, create tickets, or access enterprise systems autonomously, you are in Agentic Top 10 territory. The mistake is assuming one replaces the other.

The Agentic Top 10 sits on top of the LLM Top 10. Every agent inherits model risk, but not every model integration introduces execution risk. Think of it as two layers of the same stack. The LLM Top 10 protects the cognition layer: how the system thinks, what it reveals, and how it can be manipulated. The Agentic Top 10 protects the agency layer: what the system is allowed to do, how actions are constrained, how authority is enforced, and how behavior is observed over time.

Modern AI systems require both because modern AI systems both think and act.

OWASP created both lists because the architecture changed. And when the architecture changes, the threat model follows. If your security strategy hasn’t caught up to that split, you’re still defending a chatbot while deploying an autonomous operator. That gap is where the real risk lives.