Excessive Agency.

OWASP LLM06 — granting an LLM-driven system more functionality, permissions, or autonomy than it actually needs, so that a successful prompt injection or model error translates into outsized real-world impact. It belongs to the AI & ML Security category of cybersecurity.

OWASP LLM06 — granting an LLM-driven system more functionality, permissions, or autonomy than it actually needs, so that a successful prompt injection or model error translates into outsized real-world impact.

Excessive Agency is item LLM06 in the OWASP Top 10 for Large Language Model Applications. It describes the class of harms that occur when an LLM-based system is given more tools, broader permissions, or higher autonomy than its use case requires — for example, a customer-support agent with write access to the production billing API, or a code assistant that can both read repositories and push to main without review. The vulnerability is not the model itself but the surrounding system: when the agent is later subverted (via prompt injection, hallucination, or simply a bad day), the blast radius is shaped entirely by what powers it was granted. Mitigations follow least-privilege design: scope each tool to the minimum data and action it needs, require human approval for irreversible operations, prefer read-only or staging tools wherever possible, separate planning and acting models, and instrument tool calls so anomalous sequences surface in detection.

Defences for Excessive Agency typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: LLM06, Over-privileged AI agent.