Excessive agency
An LLM application or agent can take damaging actions because its tools have more functionality, permission or autonomy than the task needs (OWASP LLM03:2026).
- Defined in
- OWASP Top 10 for LLM Applications 2026
- Identifiers
- LLM03:2026 Excessive Agency
Covered in
Authorize agent tools outside the model
Bind each proposed action to the user, resource and approved arguments before allowing a tool to cause a side effect.
Worked threat model: an LLM agent with tools
A complete worked threat model for an LLM agent with tools: the data-flow diagram, the threats from prompt injection, excessive agency, data exfiltration, confused-deputy and memory poisoning, and the mitigations, mapped to the OWASP Top 10 for LLM Applications 2026 and the OWASP Top 10 for Agentic Applications 2026.
Red-team LLM applications and agents by their effects
A red-teaming method for LLM features and agents: scope the whole system, map attacks to OWASP and MITRE ATLAS identifiers, score trials from observed effects, report rates with confidence intervals and retest on every model or provider change.
Contain prompt injection at the application boundary
Assume retrieved content can influence model output; enforce data access and consequential actions in components the model cannot authorize for itself.
Constrain MCP and multi-agent trust boundaries
Validate each connection and delegated action without treating a token for another service, a tool description, another agent or a state handle as authority.
Secure AI-assisted development with coding assistants and agents
Treat generated code, suggested packages, repository text and MCP servers as untrusted inputs, and confine coding agents with OS-level isolation and short-lived, narrowly scoped credentials.
All 10 pages that cover Excessive agency in the library
Practice: Excessive agency lab: Bind an agent’s action to the approved arguments · Local project: Enforce retrieval and tool boundaries across crashes · Local project: Gate model and provider changes on a versioned red-team corpus · Local project: Run model-generated Python in a locked-down container