People tend to trust fluent, confident agents, and attackers exploit that trust to obtain approvals or disclosures the person would refuse if they saw the real request.
- Show approvers the exact action, arguments and data involved, not the agent’s summary of them.
- Make it clear when content comes from an agent and when an agent is acting on someone’s behalf.
- Require independent confirmation for high-risk approvals.
Guides on this site
Authorize agent tools outside the model
Bind each proposed action to the user, resource and approved arguments before allowing a tool to cause a side effect.
Contain LLM misinformation (OWASP LLM07:2026)
Stop plausible but wrong model output from driving decisions and actions: ground answers in sources, verify every citation, separate generation from execution with a claim-check-act pattern, gate consequential actions on a human, and evaluate factuality on your own domain.
Sandbox model-generated code and computer-use agents
Run the code an agent writes, and agents that drive a browser or desktop, inside a boundary built for hostile code: a disposable runtime with no secrets and no default network, hard resource limits, and a person in front of every side effect.
Practice
- Excessive agency lab: Bind an agent’s action to the approved arguments · Browser lab
- Enforce retrieval and tool boundaries across crashes · Local project
- Run model-generated Python in a locked-down container · Local project
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.