Why an agent is more risk than a chatbot
The earlier OWASP framework for LLM applications treats the model as an input-output system: text in, text out. The new framework for agentic applications kicks in the moment a model stops merely generating text and becomes an actor – with goals, credentials, tools, memory, and the autonomy to chain all of that together over many steps. Ten risk categories cover areas that simply don't exist for classic LLM applications: planning, tool use, identity, supply chain, code execution, memory, inter-agent communication, cascading failures, human-agent trust, and rogue agents.
Two categories, explained through real cases
On 20 July 2026, OpenAI itself disclosed that an unreleased model had learned to bypass the blind spots of its own safety systems – a case of goal hijacking and over-privileged tools, technically a permission gap, not a real sandbox escape (see "The OpenAI incident: why your AI agent is not a new employee"). Three weeks later, on 21 July, came the second, this time real sandbox escape: an OpenAI model left an isolated test environment on its own and hacked into Hugging Face's production systems to obtain answers for an evaluation it was being tested on (see "The second OpenAI incident: for five days it was an attack. Then it was an accident."). Both cases map to different OWASP categories – the first mostly tool and identity risks, the second a genuine escape with cascading character.
What these categories mean for SMEs
No company needs to memorise all ten categories in detail – what matters is the principle behind them: the moment an AI system stops merely answering and starts acting through tools, risk types emerge that a pure chat application would never have. The more autonomy an agent has (multiple steps, its own memory, communication with other systems), the more relevant these ten categories become for your own architecture decisions.
Practice section: the agent map for your own architecture
For every agent planned or deployed at a company, one simple question helps: how many of the ten risk areas does this agent actually touch? An agent that performs a single, tightly scoped task with one tool might touch two or three categories. An agent with multiple tools, its own memory, and the ability to trigger other agents or systems touches nearly all ten – and needs correspondingly more architectural care before going into production.