The risk of an attack in the coming months is now “probable” rather than “possible”, say authorities.
The “bomb-like device”, which was about 30cm wide, was made safe by police after it was discovered on Saturday night.
It is thought the object had been capable of causing only a limited amount of damage.
A 17-year-old asylum-seeker from Russia has been arrested in connection with the incident.
He was detained on suspicion of handling explosives, said prosecutors.
The teenager was known to intelligence agencies and was allegedly part of “extreme Islamism” circles in Norway.
“(Norwegian security service) PST is now working on finding his intentions and find out whether others are involved,” said chief prosecutor Signe Aaling.
PST head Benedicte Bjornland said: “It is not yet clear whether the suspect was acting alone.”
Referring to other terror incidents in Europe, she added: “It is likely that attacks in France, Germany, Great Britain, Russia and Sweden can create a copycat effect in Norway with people with Islamic sympathies.”
The youth has not been identified publicly but it is known he arrived in the country with his family in 2010.
A large area of the Norwegian capital was cordoned off after Saturday’s security alert.
Investigators said the explosive device was discovered outside Groenland underground station, and armed officers swept through the area to evacuate people from bars and restaurants.
Police in Scandinavia have been on heightened alert after a lorry was driven through a crowd in the Swedish capital Stockholm on Friday.
Four people, including a British man, were killed and 15 hurt in an attack claimed by Islamic State.