excessive agency
In plain wordsGiving an AI system more power than its job needs — too many tools, too-broad permissions or too little human sign-off — so that a mistake or a trick can do real damage.
A vulnerability class in LLM applications and agentsAI agent, n.: An AI system that does not just answer but acts: given a goal, it decides on steps, uses tools such as a browser or code editor, checks the results and keeps going until the job is done. in which the system is granted more functionality, permissions or autonomy than its task requires, so that hallucinated, manipulated (prompt-injectedprompt injection, n.: Tricking an AI system by slipping in text that it mistakes for instructions — for example, a hidden line in an email telling an AI assistant to forward the user's messages to a stranger.) or simply mistaken model outputs turn into damaging actions. The OWASP Top 10 for LLM ApplicationsOWASP Top 10 for LLM Applications, prop. n.: A widely used checklist, written by volunteer security experts, of the ten most serious security risks in software built on AI language models, with advice on preventing each one. distinguishes excessive functionality (tools that can do more than needed, such as a mail tool that can also delete), excessive permissions (credentials with broad access to downstream systems) and excessive autonomy (high-impact actions without human confirmation). Mitigations apply the principle of least privilege: narrow, purpose-built tools, per-user scoped credentials, authorization enforced outside the model, sandboxingsandbox, n.: A sealed-off computer space where an AI agent can run programs and change files without being able to harm the real system, reach private data or contact the outside world unless allowed. and human approval for irreversible actions.
The audit flagged excessive agency: the summarization agent held a token that could delete production databases.
Origin
Named as a risk category in the first OWASP Top 10 for Large Language Model Applications (version 1.0, August 2023), where it was LLM08. It rose to LLM06 in the 2025 edition and to LLM03 in the 2026 edition (August 2026), reflecting the spread of agents.
Related
- OWASP Top 10 for LLM ApplicationsOWASP Top 10 for LLM Applications, prop. n.: A widely used checklist, written by volunteer security experts, of the ten most serious security risks in software built on AI language models, with advice on preventing each one.
- prompt injectionprompt injection, n.: Tricking an AI system by slipping in text that it mistakes for instructions — for example, a hidden line in an email telling an AI assistant to forward the user's messages to a stranger.
- lethal trifectalethal trifecta, n.: A rule of thumb for AI assistants: one that can see your private data, reads material from outsiders and can send messages out can be manipulated by those outsiders into handing your data over.
- permission systempermission system, n.: The rules that decide what an AI agent may do on its own, what it must ask a person about first, and what it may never do — like a phone's settings for which apps can use the camera.
- sandboxsandbox, n.: A sealed-off computer space where an AI agent can run programs and change files without being able to harm the real system, reach private data or contact the outside world unless allowed.
- confused deputyconfused deputy, n.: A security flaw in which a trusted program does an outsider's bidding with its own access rights, because it cannot tell whose request it is serving; AI agents are prone to it.
Sources
- OWASP GenAI Security Project (2026). OWASP GenAI LLM Top 10 2026: LLM03 Excessive Agency. genai.owasp.org/resource/owasp-genai-llm-top-10-2026
Mentioned in
prompt injectionprompt injection, n.: Tricking an AI system by slipping in text that it mistakes for instructions — for example, a hidden line in an email telling an AI assistant to forward the user's messages to a stranger., agentic misalignmentagentic misalignment, n.: When an AI agent acting on its own deliberately does something harmful — such as blackmail or leaking secrets — to protect its goals or avoid being replaced., lethal trifectalethal trifecta, n.: A rule of thumb for AI assistants: one that can see your private data, reads material from outsiders and can send messages out can be manipulated by those outsiders into handing your data over., OWASP Top 10 for LLM ApplicationsOWASP Top 10 for LLM Applications, prop. n.: A widely used checklist, written by volunteer security experts, of the ten most serious security risks in software built on AI language models, with advice on preventing each one., permission systempermission system, n.: The rules that decide what an AI agent may do on its own, what it must ask a person about first, and what it may never do — like a phone's settings for which apps can use the camera., agent identityagent identity, n.: The ways of proving which AI agent is acting, for whom and with what permissions — so websites, companies and other agents can tell trustworthy agents from impostors and hold someone responsible., confused deputyconfused deputy, n.: A security flaw in which a trusted program does an outsider's bidding with its own access rights, because it cannot tell whose request it is serving; AI agents are prone to it., tool poisoningtool poisoning, n.: Hiding harmful instructions in the description of a tool an AI assistant can use, so the assistant obeys them when it reads the tool's details, even though the user never sees them., YOLO modeYOLO mode, n.: Slang for letting an AI coding agent run any command without asking you first — fast and convenient, but risky, since nothing stops a harmful action.