LLM06: Excessive Agency · 2025

Excessive tools, permissions or autonomy turn hallucinations or injection into harmful actions on connected systems.

Summary

Excessive tools, permissions or autonomy turn hallucinations or injection into harmful actions on connected systems.

How the attack works

A drafting assistant has a message-sending tool and broad permissions; model output triggers an action without approval.

Example

Vulnerable · Pseudocode

agent.tools = mail.send_all
agent.approval_required = False
agent.run("Draft a meeting reminder")

Fix: Restrict tools and recipients, authorize every call outside the LLM and require approval before sending.

Prevention

Minimize tools and permissions.
Authorize every action deterministically.
Require human approval and use limits or circuit breakers.

Lineage

2025 · LLM06: Excessive Agency Moves up to rank 3 in 2026
2026 · LLM03: Excessive Agency Moves up from rank 6

2025:LLM06 → 2026:LLM03: Excessive Agency moves up from rank 6 to 3 as agents are adopted.

Sources

Open official source ↗

Buy me a coffee