OWASP Top 10 for LLMs
LLM06
Excessive Agency
Agents with broad permissions can be steered into destructive or unauthorized actions.
Agency is the ability of an LLM system to take actions through tools. Excessive functionality, permissions, or autonomy means a successful injection can cause real damage — deleting data, sending messages, or spending money — because the model was trusted to act with too little oversight.
How it shows up
- An agent with an unsandboxed shell tool follows injected instructions to delete files.
- A model with broad OAuth scopes sends emails on a user's behalf after manipulation.
- An autonomous workflow makes purchases without human confirmation.
Mitigations
- Apply least privilege to every tool and credential the agent can use.
- Gate destructive or high-value actions behind human-in-the-loop approval.
- Use allow-lists for tools and validate all tool arguments.
- Log and monitor agent actions for anomalous behavior.