LLM03: Excessive Agency · 2026
An application with excessive tools, permissions or autonomy turns incorrect or manipulated outputs into harmful real-world actions.
Summary
An application with excessive tools, permissions or autonomy turns incorrect or manipulated outputs into harmful real-world actions.
How the attack works
A drafting assistant has a message-sending tool and broad permissions; model output triggers an action without approval.
Example
Vulnerable · Pseudocodeagent.tools = mail.send_all
agent.approval_required = False
agent.run("Draft a meeting reminder")Fix: Restrict tools and recipients, authorize every call outside the LLM and require approval before sending.
Prevention
- Offer only minimal functions with strict schemas.
- Preserve the user's authorization context.
- Mediate actions with policies, human approval and circuit breakers.
Lineage
- 2025 · LLM06: Excessive Agency Moves up to rank 3 in 2026
- 2026 · LLM03: Excessive Agency Moves up from rank 6
- 2025:LLM06 → 2026:LLM03: Excessive Agency moves up from rank 6 to 3 as agents are adopted.