Excessive agency

OWASP moved Excessive Agency from LLM08 in the 2023 list to LLM06 in the 2025 edition and breaks it into three root causes. Excessive functionality: the agent has tools it does not need, or a tool exposes more operations than the task requires - a plugin meant to read documents that can also delete them, a generic shell or HTTP tool where a narrow function would do, or a tool left over from development. Excessive permissions: the tool authenticates to downstream systems with more rights than needed, typically a shared service account with read-write access to every mailbox or table instead of the invoking user's scoped identity. Excessive autonomy: high-impact actions execute without independent verification or human approval.

The trigger for harm is any output the model produces that the surrounding code treats as a command - a hallucination, a misread instruction, or, most importantly, indirect prompt injection from content the agent reads. In classic security terms the agent is a confused deputy: it holds authority granted by its owner and can be steered by a less-privileged party to exercise it. The "lethal trifecta" described by Simon Willison in 2025 - access to private data, exposure to untrusted content, and an exfiltration channel - is a practical test: if all three are present in one agent, assume a successful injection can leak data. Tool ecosystems such as MCP add further paths, because tool descriptions and tool results are themselves text in the model's context.

Mitigations are ordinary access-control engineering applied to the orchestrator, not to the model. Expose only the tools a use case needs; prefer narrow, typed functions (send_reply_to_ticket(ticket_id, body)) over open-ended ones (run_shell, http_request); use OAuth with minimal scopes and execute in the end user's security context so the agent cannot exceed what the user may do; enforce authorisation in the downstream API (complete mediation) rather than trusting the model to ask permission; require human-in-the-loop confirmation for irreversible or external actions such as payments, deletions and outbound email; add rate limits and spending caps; and log every tool call with arguments for audit. Sandboxing code execution and restricting egress by allow-list address the exfiltration leg.

Excessive agency is a design weakness, not an attack: it determines the blast radius once something else goes wrong. It differs from privilege escalation, where an attacker obtains rights they were never granted, and from improper output handling (LLM05), where model output is passed unsanitised into an interpreter such as SQL, a shell or a browser. Governance frameworks increasingly expect agent permissions to be included in access reviews, just like any other non-human identity.