Excessive Agency
- Tools & External Data
- Output / Actuation
An agent is granted more autonomous capability — tools, permissions, or unsupervised action — than its task requires, so a model error or manipulation can act, not merely answer wrong.
What it is
Excessive agency is the vulnerability that lets an LLM-based system perform damaging actions in response to unexpected, ambiguous, or manipulated output — regardless of whether hallucination, a poorly engineered prompt, or direct or indirect prompt injection is what set the model off. Its root cause is one or more of excessive functionality (a tool can do more than the task needs), excessive permissions (the tool's downstream credential can reach more than the task needs), or excessive autonomy (a high-impact action executes without independent verification). It differs from Improper Output Handling in scope: that vulnerability is about insufficient scrutiny of what a model outputs, this one is about how much a model-directed system is able to do once it decides to act. A multi-agent system widens every one of these triggers: repeated LLM calls chain output into the next invocation, so a single hallucinated or injected instruction can steer a whole sequence of actions, and a compromised or malicious peer agent becomes a new source of the manipulated input that excessive agency turns into real-world impact.
Kinds
- Excessive functionality
- A tool or extension implements more capability than the task needs — a document-reading integration that can also modify or delete, or an open-ended shell command where a narrow, single-purpose action would do.
- Excessive permissions
- The identity a tool uses to reach a downstream system carries broader access than the task requires — a read-only task connects with a credential that also holds update, insert, or delete rights.
- Excessive autonomy
- A high-impact action executes without independent verification or human confirmation, so a manipulated or hallucinating run can complete an irreversible action unsupervised.
Attack scenarios
A scheduling agent holds an unrestricted send-email tool for a task that only ever needs to draft one, and a manipulated run sends it without review.
Overprivileged mail assistant
A personal-assistant agent is granted a mail extension that can both read and send messages, though its task only needs reading. An indirect prompt injection in an incoming email tricks the agent into scanning the inbox for sensitive information and forwarding it to the attacker.
Broad database credential
An extension meant only to read a products table connects with an identity that also holds update, insert, and delete rights, so a manipulated run can alter or erase records it was only ever supposed to read.
Shared privileged document access
An extension designed to act within one user's context instead authenticates with a generic high-privilege account, so a compromised run reaches every user's files rather than just its own.
Unconfirmed high-impact action
A document-management extension performs deletions with no confirmation step, so a single hallucinated instruction destroys real data with no human ever in the loop.
Mitigations
- Minimize functionality and permissions
- Grant each tool only the functions and downstream access its task requires, per Permission-scoped Tools and Least Privilege Agent — an open-ended tool (run any shell command) should be replaced by a narrow, purpose-built one wherever possible.
- Execute in the acting user's own context
- Track user authorization and scope so actions run downstream with that user's own privileges, never a shared elevated identity, and enforce authorization in the downstream system rather than trusting the model's decision.
- Require human approval for high-impact actions
- Gate irreversible or high-consequence actions — send, delete, pay — behind a HITL Approval Gate so a manipulated or hallucinating run cannot complete them unsupervised.
- Log, monitor, and rate-limit as a backstop
- Even with the above in place, log extension activity to catch undesirable actions after the fact, and rate-limit to bound the damage a single compromised run can do before it's noticed.