Excessive agency

When an artificial intelligence (AI) agent can do more than its job needs, through extra tools, wider access, or freedom to act without asking, so a mistake or an attack causes more harm than it should.

An assistant built to summarize email might also be able to send and delete messages, or a shopping agent might pay for anything without a spending cap.

A security weakness that lets an agent take damaging actions in response to unexpected, ambiguous, or manipulated output from its large language model (LLM), whether the cause is a model error or a prompt injection attack. The Open Worldwide Application Security Project (OWASP), one widely used benchmark, listed it as LLM06 in its 2025 Top 10 for LLM Applications and ranked it third in the 2026 edition.

OWASP traces it to three root causes:

• Excessive functionality, such as a document reader that can also delete files.
• Excessive permissions, such as database access that allows edits when reading would do.
• Excessive autonomy, such as taking high-impact actions without a person confirming them.

The standard mitigation is the principle of least privilege: give each agent, tool, and credential only the access its task requires. In practice that means removing unneeded and open-ended tools, running each action with the user's own narrowly scoped rights, requiring human approval for actions such as payments or deletions, and having downstream systems enforce permissions instead of trusting the agent to decide.

Excessive agency sits next to terms that are easy to mix up:

• Agent mandate is the permission a person grants, and excessive agency is when the agent's technical access goes beyond it.
• Agent hijacking is an attack that turns excessive agency into real damage.
• Authorization decides what a party may do, and least privilege is how it is applied to agents.

For more, see LLM06:2025 Excessive Agency.