AI Security · Learn

What is excessive agency?

When an LLM agent is given more autonomy, permissions, or tools than a task needs, a single manipulated prompt can turn it into an attacker's hands inside your systems.

AI Security · LearnAI Penetration Testing Download PDF
TL;DR

Excessive agency (OWASP LLM06:2025) is the risk that an LLM-based agent can take harmful actions because it has more functionality, permissions, or autonomy than it needs. When an attacker influences the model through prompt injection or a poisoned data source, the agent uses that excess capability, deleting records, sending email, calling paid APIs, to act on the attacker's behalf. The fix is least privilege: minimal tools, scoped permissions, and human approval for high-impact actions.

By Rohit Hatagale, AI Security Lead, SecureLayer7Updated

What excessive agency is

Agents wire an LLM to tools: functions, APIs, shells, databases. Excessive agency is when the agent can do more than the task requires, too many tools, tools that are too powerful, permissions that are too broad, or autonomy to act without confirmation. The model's non-deterministic output then decides what happens, and an attacker who steers the model inherits every capability you granted it.

How the attack works

The attacker does not exploit a memory bug, they manipulate the model. Through direct prompt injection or an indirect payload in retrieved content (a web page, a document, an email the agent reads) they instruct the agent to use its tools against you: forward the latest invoices to an external address, run a shell command, grant a user admin. If the agent holds the credential and the tool, it complies. Excess permission turns a text bug into real-world impact. Shown for defensive testing.

How to defend against it

Apply least privilege to the agent, not just the user. Give it the minimum set of tools, scope each tool's permissions tightly, and prefer read-only or narrow write actions. Require human approval for high-impact or irreversible actions, rate-limit and log every tool call, and run tools with the caller's identity so the agent cannot exceed what the user is allowed to do. Treat all retrieved content as untrusted input.

References

  1. [1]OWASP Top 10 for LLM Applications (2025)(OWASP)
  2. [2]MITRE ATLAS (adversarial threat landscape for AI systems)(MITRE ATLAS)
Related terms

An over-permissioned agent turns one bad prompt into real damage. Talk to a security expert about testing what your AI agents can actually do.

Related service
AI Penetration Testing
Adversarial testing of your LLM and AI features, prompt injection, data exfiltration, and agent abuse, with reproducible findings.
AI penetration testing

FAQ

Excessive agency, asked often

Scope an engagement

Test your AI application before an attacker does.

Our AI red team probes your LLM and agent features the way an attacker would, prompt injection, tool abuse, and data exfiltration, and ships findings with reproducible attacks and fixes your team can implement.