Excessive agency vs Privilege escalation

Why they differ

In privilege escalation an attacker gains rights they were never given; with excessive agency the rights were handed over from the start.

Excessive agency

AI risk & governance

Giving an AI system more tools, rights or freedom to act than its job needs, so one wrong or tricked step can do real damage.

Formal

A weakness (OWASP LLM06:2025) in which a system built on a large language model has too many functions, permissions or independence, so unexpected, manipulated or made-up model output can trigger harmful actions.

In plain English

Like giving a new intern the master key, the company card and the power to sign contracts on day one, when all they were hired to do is sort the post.

In practice

A shipping company's booking agent only needs to read the sailing schedule, but was given rights to change it; it misreads one customer's email and cancels forty bookings before an operations planner notices.

Why it matters

No model can be made fully trustworthy, so limiting what it may do caps the damage when it is wrong or hijacked; the risk grows with every tool an agent gets.

Privilege escalation

Fundamentals

An attacker who has a small foothold gaining more rights than they were given, up to full control of the system.

Formal

The step in an attack where someone with limited rights on a system uses a flaw, a poor setting or a stolen credential to gain higher rights, typically those of a privileged account or the operating system itself.

In plain English

Like a hotel guest whose card opens only one room, who finds a way to turn it into the manager's master key.

In practice

After a phishing mail gives an attacker the login of an ordinary clerk at a Danish ministry, he finds a program on her laptop that runs with admin rights and can be tricked into running his code - and now controls the whole machine.

Why it matters

An ordinary account can do limited harm; once the attacker holds the highest rights they can turn off protection, hide their tracks and reach everything.

Shared connections

Principle of least privilege