The simple difference
LLM Top 10
AI is part of an app.
- prompts
- outputs
- retrieved context
- model behavior
- sensitive information
- generated code
- embeddings
- supply chain
- output handling
“What did the AI read, say, reveal, or generate?”
Agentic Top 10
AI can act.
- tools
- identity
- privileges
- memory across sessions
- agent-to-agent communication
- code execution
- cascading failures
- rogue agents
“What can the AI do, who allowed it, and what happens next?”
When does LLM risk become agentic risk?
Risk shifts as the AI gains the power to act. Here's the ladder:
-
AI answers a questionMostly LLM riskThe AI gives a wrong answer or leaks private data.
-
AI uses retrieved documentsStill LLM risk, but closer to agenticRAG pulls hidden or poisoned context.
-
AI calls a toolNow agentic risk beginsThe AI sends an email, deletes a file, creates a ticket, buys something, or changes a setting.
-
AI remembers and acts laterStrong agentic riskBad memory affects a future decision.
-
AI coordinates with other agentsFull agentic riskOne agent gives bad instructions to another agent.
Theme crosswalk
Not a one-to-one map — a way to see the same idea through both lenses.
| Theme | LLM Top 10 lens | Agentic Top 10 lens | Robot Explains question |
|---|---|---|---|
| Instructions | Prompt Injection | Agent Goal Hijack | Who is steering the AI? |
| Tools | Improper Output Handling / Excessive Agency | Tool Misuse and Exploitation | What can the AI do next? |
| Permissions | Excessive Agency | Identity and Privilege Abuse | Is ability the same as authority? |
| Memory | Prompt Injection / Vector Weaknesses | Memory and Context Poisoning | What does the AI remember? |
| Supply chain | Supply Chain | Agentic Supply Chain Vulnerabilities | Did we load what we thought? |
| Wrong answers | Misinformation | Cascading Failures / Trust Exploitation | Can fluent wrong output cause action? |
| Secrets | Sensitive Information Disclosure / Hidden Context Exposure | Tool Misuse / Identity Abuse | What can leak, and through what path? |
| Autonomy | Excessive Agency / Unbounded Consumption | Rogue Agents / Cascading Failures | Who stops the loop? |
For example: a chatbot that gives a wrong answer is mostly an LLM risk. A chatbot that uses that wrong answer to send an email, update a ticket, or approve a payment has become an agentic risk.
Robot's translation
LLM Top 10 asks: Is the AI handling words, data, prompts, and outputs safely?
Agentic Top 10 asks: Is the AI acting safely — with the right tools, permissions, memory, and human checks?
Together they ask: Can the AI understand safely, answer safely, and act safely?
Safety checks that show up again and again
Identity
Do we know which agent is acting?
Permissions
Is it allowed to do this?
Containment
How far can damage spread?
Monitoring
Can we see what happened?
Human gates
When does a person need to approve?
Schemas
Are inputs and outputs shaped so they can be checked?
Provenance
Do we know where the model, tool, prompt, or data came from?
App risk vs. agent risk, at a glance
The AI mostly reads, answers, summarizes, or generates.
The moment it can act, the risk changes.
“Words can become actions. That's when we need stronger checks!”
The AI remembers, calls tools, uses permissions, acts later, or affects other systems.
★ Robot Rule
Ability is not authority.
Just because AI can do something does not mean it is allowed to do it.
LLM security asks whether the AI handles information safely. Agentic security asks whether the AI acts safely. Modern AI systems often need both.
Where to go next
About this page & license
Robot Explains is an educational adaptation and simplification — it is not official OWASP guidance. For the official material, see the OWASP GenAI Security Project (LLM Top 10 and the Agentic Security Initiative's Top 10 for Agentic Applications). The AIUC-1 crosswalk is a separate control-mapping document; this page adapts only the conceptual boundary.
The OWASP material is licensed under Creative Commons Attribution-ShareAlike 4.0 (CC BY-SA 4.0), and this adaptation is shared under the same license, with changes indicated.