Model as component vs. model as actor
OWASP's own boundary, and what splits this course into two halves.
A short module with a large consequence. One boundary determines which threat model applies to the system, which standard you should be reading, and how bad the worst day can be. It has nothing to do with model capability. It is whether the model generates output or takes actions.
The boundary
OWASP's project leads draw it explicitly, and treat it as the most important structural distinction in the field:
This list owns the risk when the model is a component inside your application. The moment that model becomes an actor, with tools it can call, memory it carries between sessions, and consequences it sets in motion downstream, the risk moves to the OWASP Agentic Top 10.
Read the three markers as a checklist: tools it can call, memory it carries between sessions, consequences it sets in motion downstream. Any one moves you across the line. All three and you are in agentic territory whether or not anyone used that word in a design review.
| Model as component | Model as actor | |
|---|---|---|
| What it produces | Text, or structured output the code reads | Tool calls that change the world |
| Worst case | Wrong or harmful text | State change, exfiltration, lateral movement, code execution |
| Persistence | None. The request ends | Memory and RAG carry compromise into future sessions |
| Blast radius | The conversation | Whatever the tools can reach |
| Governing framework | OWASP LLM Top 10 2026 | OWASP Agentic Top 10 (ASI01–10) |
Why the same injection has two severities
Take one successful prompt injection and drop it into each architecture. The attack is identical. The outcome is not.
injection ──▶ model produces incorrect text ──▶ a human reads something wronginjection ──▶ agent's goal changes
──▶ tool selection changes
├─▶ read sensitive data
├─▶ change database state
├─▶ send external message
├─▶ execute code
├─▶ write persistent memory
└─▶ instruct another agentWhich is why “we tested for jailbreaks and it's fine” answers nothing for an agentic system. You measured the first diagram and shipped the second.
Bounds blast radius· survives adaptive attack
Neither list covers the ground alone
The leads are direct about how to use the two documents:
Many of the incidents we read sit right on that boundary. Read an entry here for the model-as-component failure. When your model starts acting on its own, pair it with the Agentic list, because neither one covers that ground alone.
Take “many of the incidents sit right on that boundary” seriously. Real incidents rarely stay purely one or the other. They start as a model-layer failure and become an agentic one. The GitHub MCP case in module 3.3 is exactly this: an injection (LLM01) that mattered only because the agent held elevated credentials (ASI03) and could reach private repositories (ASI01).
Deep diveHow OWASP moved risks across the boundary in 20263 min›
The 2026 edition is where this split became load-bearing, visible in the scope notes. Several LLM entries now explicitly hand off. LLM04 Supply Chain defers MCP servers and tool registries to ASI04 Agentic Supply Chain. LLM08 Hidden Context Exposure defers persistent-memory concerns to ASI06 Memory & Context Poisoning and inter-agent amplification to ASI07 Insecure Inter-Agent Communication.
The publication order is counterintuitive. The Agentic Top 10 came first, announced 9 December 2025, and the LLM Top 10 2026 followed on 4 August 2026. The LLM list was written with the agentic list already in hand, which is why its scope notes defer so cleanly. For an agentic system the ASI list is the primary document, and the LLM list tells you how the model-layer entry point behaves.
Check yourself
1. Name the three markers that make a model an actor rather than a
component.
2. A model produces JSON that the backend validates and then uses to
update a record. Component or actor?
3. Which of the two OWASP lists was published first, and why does that
ordering matter when you read the scope notes?
4. Why is "we tested for jailbreaks" an insufficient answer for an
agentic system?Sources