The domestic intelligence agency PST said an attack was now “probable” rather than “possible”, because of the risk of a copycat attack after recent assaults in Stockholm, Saint Petersburg, London, Berlin and Nice.
The new threat level will be in place for two months.
“It's not clear whether the 17-year-old young man intended to commit a terrorist attack,” PST chief Benedicte Bjørnland told reporters.
The teen's lawyer, Aase Karine Sigmond, said her client rejected the allegations, as well as claims in the media that he was an Islamic State (Isis) sympathiser.
“It was a boy's prank,” she told broadcaster NRK.
The intelligence agency was trying to determine whether he had acted alone.
The incident came after a deadly truck attack that left four people dead and 15 injured in Stockholm in neighbouring Sweden.
Norwegian police had earlier announced that they had carried out a controlled explosion overnight Saturday and that they had made an arrest.
Police had cordoned off part of Oslo's busy Grønland district and evacuated local bars and restaurants after the device was discovered Saturday evening.
The device turned out to be a “primitive explosive device” with the capacity to cause only “limited” damage, said another PST official, Signe Alling.
The suspect had arrived in Norway in 2010 with his family, which had sought asylum. He was already known to intelligence circles.
“He was cause for concern previously, but we don't want to comment on which milieu he was part of,” Bjørnland said.
Memories are still fresh in Norway of the July 2011 twin attacks perpetrated by right wing extremist Anders Behring Breivik, who killed 77 people in a bombing near the government offices in Oslo and a gun rampage on the Utøya island.