excessive agency

advancedspreading

Security risk: an AI agent is granted more tools, access, or autonomy than needed for its task, so a mistake or deception could cause real harm.

In plain terms

Imagine handing the cleaner not only your flat key but also your bank card, your PIN and your car key, 'just in case'. Probably nothing will go wrong, but if they make a mistake or someone tricks them, the damage is far greater than anything a cleaning job could ever involve. Excessive agency is the same thing in the world of AI.

An AI agent does not just write text, it acts: it sends emails, deletes files, places orders, makes payments and modifies databases. The problem begins when it can do more than its task justifies, for example when it is given permission to send and delete just to summarize your emails.

This is not about the agent being "evil" but about poor design. The language model can make mistakes, misread a request, or be hijacked by an instruction hidden in a webpage or email. Whether the result is an annoying error or serious damage depends on the permissions the agent has been given.

How it works

An agent is linked to tools (email, calendar, file manager, payments, corporate systems) and can act in the world through them.
Three typical errors occur: too many features (including tools unnecessary for the task), overly broad permissions (write and delete instead of just read), and excessive autonomy (executing critical steps without approval).
Something goes wrong: the model makes an error, receives an ambiguous instruction, or a hidden text in a document persuades it to do something you did not request.
Since the agent has the necessary authority, it executes the step: it sends the data, deletes the folder, or initiates the transfer.
The defense follows the 'least privilege' principle: only absolutely necessary tools, restricted access, human approval before irreversible steps, and logging.

An everyday example

You ask an AI assistant to summarize your incoming emails and, for convenience, grant it full access to your inbox. One email contains a hidden instruction: forward the latest bills to this address. Since the agent has sending rights, it does so, even though reading would have been sufficient for the task.

Who is affected

developerThey decide what tools and permissions the agent receives, so much of the risk is determined at the design stage. → Code

entrepreneur, executiveIf a company agent incorrectly deletes, orders, or leaks data, the company is typically liable for the damage and legal consequences, not the machine.

employeeWhen you link your work account to an AI assistant, you decide how much access it has on your behalf. → Work & HR

everyoneAnyone who gives an AI assistant access to their emails, files, or bank card faces the same question.

A common misconception

MythExcessive permissions mean the AI becomes willful and causes harm of its own accord.

In realityAn agent can only do what its available tools and access permissions allow. The error lies in granting more tools, access, or autonomy than necessary, which a mistake or an attacker then exploits.

Limits and risks

Limiting permissions does not prevent errors, only limits the damage: the agent can still make mistakes and be misled.
Comfort and security work against each other here: the fewer approvals an agent requires, the higher the risk.
Human approval protects only if you actually read what you approve. Many pop-up questions lead to mechanical clicking.
A permission that seems harmless, such as 'full access to the drive,' may cover much more than the task requires, so it is worth reviewing and revoking granted rights periodically.

Similar, but not the same

prompt injection – Prompt injection is the attack itself, through which a false instruction is fed to the agent directly or hidden in a document or webpage; excessive privilege is the weakness that allows a successful attack to cause major damage.
hallucination – A hallucination is a false statement in the response; excessive authority turns such an error into a real, executed action.
autonomy – Autonomy is the neutral measure of an agent's independence, while overreach occurs when this independence and access exceed the justified level for the task.

Related concepts

Broader

AI safety, AI-agent, risk management

Narrower

excessive functionality, excessive permissions, excessive autonomy

On the edge

prompt injection, principle of least privilege, human approval, tool use, guardrail

A brief history

The concept was made known by the OWASP international security professional community: in 2023, it was included in the first edition of its list of the ten most important risks for applications built on large language models, then with the number LLM08. In the edition of the list published at the end of 2024, marked 2025, it appears with the number LLM06 and a more detailed description, because the weight of the risk has increased with the spread of agents. In December 2025, OWASP also issued a separate top-ten list on the risks of applications built on agents.

Where things stand

By the end of 2026, agents are already sending emails, writing code, and making purchases, making risk a daily practical question. Restricting permissions and requiring human approval are established recommendations, but in practice, many agents still have broader access than necessary.

Status: 2026 November

Also known as

excessive agency · excessive agency · excessive agency · excessive agent permissions · LLM06 Excessive Agency · LLM08 Excessive Agency (2023)

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.