Skip to content
MoorAI
02 — attack concepts

Excessive agency

Also written OWASP LLM06

The OWASP Top 10 for LLM Applications entry (LLM06:2025) for a system that can be made to take damaging actions in response to unexpected, ambiguous or manipulated model output, whatever caused the model to misbehave. OWASP names three root causes: excessive functionality, excessive permissions and excessive autonomy. Each is reduced the same way: fewer tools, narrower permissions, and a human or a policy check before a high-impact action.

See also least privilege for AI agents · permission right-sizing · OWASP LLM Top 10 · permission right-sizer

Sources

Related terms

  • Least privilege for AI agents Defence & response

    The principle that an agent gets only the tools, files, network destinations and credentials its task needs, for only as long as it needs them.

  • Permission right-sizing Defence & response

    Cutting the permissions an agent is granted down to the ones it uses: comparing what a configuration allows — tools, commands, directories, MCP servers…

  • OWASP LLM Top 10 Frameworks & standards

    OWASP's list of the ten most critical risks in applications built on large language models — LLM01 Prompt Injection, LLM02 Sensitive Information…

Attack concepts

The mechanisms the families above exploit, plus the agent-specific ones that have no chatbot equivalent. If you only read one entry on this page, read indirect prompt injection.

Excessive agency is term 16 of 17 in this part of the glossary.

Prompt injectionDirect prompt injectionIndirect prompt injectionJailbreakObfuscation / encodingHomoglyphLeetspeakMulti-turn crescendoTool poisoningTool-name shadowingCapability expansionConfused deputyData exfiltrationLethal trifectaLiving off the AIExcessive agencyShadow AI
Get started free Full glossary → How we test → Community agent on GitHub ↗

This page is one entry from the agentic AI security glossary, which defines 82 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act, W3C Trace Context, the MCP specification — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.