LLM06: Excessive Agency
Risk Level: Critical
LLM systems are granted too much autonomy — excessive permissions, too many functions, or the ability to take high-impact actions without human oversight. When combined with prompt injection or hallucination, the model may execute harmful actions like deleting data, sending emails, or modifying production configurations.
Real-World Examples (2026)
AI IDE Code Execution: AI coding assistants (Copilot, Cursor, Claude Code) have terminal access, file system access, and can execute arbitrary code. A prompt injection via a malicious MCP tool description caused AI IDEs to spawn reverse shells — the AI's "excessive agency" (unrestricted terminal access) turned a text injection into full RCE. Full breakdown →
AI Notetaker Spread: Otter.ai spread to 80,000 corporate endpoints without IT approval. The AI agent had excessive permissions — it could auto-join meetings via calendar integration, record audio, transcribe content, and share notes. No human gate existed between "user installs app" and "app joins every meeting in the organization." Full breakdown →
Mitigations
- Limit LLM agents to the minimum set of functions required for their task
- Restrict write/delete operations — prefer read-only access where possible
- Implement human-in-the-loop gates for destructive or irreversible actions
- Use allowlists for permitted actions rather than blocklists
- Monitor agent behavior for deviations from expected action patterns