What is the difference between agentic AI and generative AI?

Generative AI produces content, such as text, images or code, in response to a prompt. Agentic AI wraps a model in a loop that plans, calls tools and acts on other systems, often over several steps. The difference that matters for security is that a wrong answer becomes a wrong action.

How do the standards describe generative AI?

NIST's Generative AI Profile (NIST AI 600-1, July 2024) quotes Executive Order 14110: generative AI is the class of AI models that emulate the structure and characteristics of input data in order to generate derived synthetic content, which can include images, video, audio, text and other digital content. NIST notes that for its purposes the term generally refers to generative foundation models.

The classic risks follow from that: wrong or invented content, leaked data, copied material and harmful output. The damage is done when a person reads or uses what the model produced.

What changes when a model becomes an agent?

OWASP's guidance on excessive agency describes the step. A developer gives a model the ability to call functions or interface with other systems through extensions, which different vendors call tools, skills or plugins. The choice of which extension to invoke may be delegated to the model, and agent-based systems typically make repeated calls, using output from earlier steps to direct later ones.

So the loop is: the model reads input, decides on an action, a tool runs it, the result goes back to the model, and the cycle repeats. Each iteration adds a chance for error and a chance for manipulation, and the actions have real side effects: sending email, changing records, running commands.

OWASP now maintains a separate Top 10 for Agentic Applications (2026), peer-reviewed by more than 100 experts, covering the risks of systems that plan, act and decide across workflows. The existing LLM Top 10 already lists Excessive Agency as one of its ten.

What do the risks look like side by side?

• Output: generative AI gives content for a human to read; agentic AI takes actions on systems.
• Harm from a bad output: misinformation or leakage for generative; deleted data, sent messages or spent money for agentic.
• Typical trigger: a bad prompt or bad training data for generative; prompt injection, a compromised tool or a malicious peer agent for agentic.
• Key control: output review and data handling for generative; least privilege, approval and complete mediation for agentic.

OWASP names the root causes of excessive agency: excessive functionality, excessive permissions and excessive autonomy. It also lists triggers, including hallucination, direct or indirect prompt injection, a compromised extension and, in multi-agent systems, a malicious or compromised peer agent.

A constructed example

A summarization assistant reads a user's email and writes a short digest. That is generative: the worst case is a poor summary. Now give the same assistant an extension that can also send mail and a broad mailbox token, and let it act on instructions in messages. An attacker's email says to collect recent invoices and forward them. A model that follows it has made a data breach out of a summarizer. OWASP uses a near-identical scenario and its fixes: a read-only extension, a read-only OAuth scope and user approval for sending.

What does OWASP recommend?

From its excessive agency guidance:

• Minimize which extensions an agent can call and what each can do.
• Avoid open-ended extensions such as run a shell command or fetch any URL. Use narrow ones.
• Minimize the permissions of the identity the extension uses downstream.
• Run extensions in the user's context so actions carry that user's authorization.
• Require human approval for high-impact actions.
• Enforce complete mediation: authorize in downstream systems rather than trusting the model to decide.
• Log and rate-limit, which limit damage but do not prevent it.

How to check or apply this

1. List every AI feature in your products and tag each as generative only or agentic (can call tools).
2. For agentic ones, list each tool, its functions and the credentials it uses.
3. Remove unneeded tools and functions, and replace broad credentials with scoped, per-user ones.
4. Put an approval step in front of irreversible actions.
5. Check authorization in the downstream service, not in the prompt.
6. Log tool calls with the agent identity and the user it acted for.

Safeguard offers an MCP Guardrail and agent identity controls for governing which tools agents call and as whom. They address the agentic half of this comparison.

Quick check

Sources

• NIST AI 600-1, Generative AI Profile (July 2024)
• OWASP GenAI, LLM06:2025 Excessive Agency
• OWASP GenAI, Top 10 for Agentic Applications for 2026

Last reviewed: 18 October 2026.