Excessive agency
An AI system holding more permission, autonomy or functionality than its task requires.
Updated
Excessive agency turns a model error or a successful injection into real damage. It usually appears as an agent using a service identity with broad rights instead of a token delegated from the requesting user. OWASP's Top 10 for LLM Applications lists it as LLM06, with three root causes: excessive functionality, excessive permissions, and excessive autonomy.
Mitigation is ordinary authorisation engineering: scope credentials per task, remove unnecessary tools, and require human confirmation for actions that cannot be undone. The risk is more consequential in multi-agent systems, where a compromised peer agent can trigger the same failure.
Related
AI security
How to secure GenAI, LLM and agentic AI systems: current OWASP threat classes, layered controls, agent authority, retrieval isolation and monitoring.
LLM security controls
A control checklist for enterprise GenAI: data handling, retrieval isolation, agent authority, cascading-failure containment, monitoring, cost limits and vendor terms.
AI security assessment
Security assessment of GenAI and LLM systems: prompt injection, tool and agent abuse, data leakage, model supply chain and monitoring gaps.
STRIDE for AI systems
Applying STRIDE to LLM and agentic applications: what each category means when untrusted text can act as instructions, where STRIDE stops covering multi-agent failure modes, and the controls per element.
Prompt injection defence
Why prompt injection cannot be filtered away, why it has no full fix yet, and how to design AI systems — architecturally, not just with better prompts — so a successful injection has no useful consequence.
Three layers, three risk profiles
A security review that skips naming its layer — model, service, or agent — ends up testing the wrong attack surface.