For Heads-of · Practitioner
Excessive Agency
Also known as: LLM03
Giving an LLM-based system more functions, permissions or autonomy than its task needs, so that a manipulated or mistaken output becomes a damaging action. It is LLM03 in the OWASP Top 10 for LLM Applications 2026, up from sixth place in 2025.
- OWASP
- LLM03
- AI agents
- least privilege
- autonomy
Definition
OWASP breaks it into three parts: excessive functionality (tools the task does not need), excessive permissions (tools with more access than the task needs) and excessive autonomy (actions taken without confirmation). Any one of them turns a model error or a prompt injection into a real-world effect.
Why it rose
In 2025 most LLM applications produced text for a person to read. By 2026 many act: sending email, changing records, calling other agents. The failure moved from a wrong answer to a wrong action, which is why OWASP moved this item up and why it sits at the centre of agentic AI governance.
Where to go next
This entry defines the term. The register entry excessive agency in autonomous agents sets out the failure and its controls, chief among them human-in-the-loop review on irreversible actions and least privilege on every tool.
Sources
Related Terms
Agentic AI
An AI system that pursues a goal by deciding for itself which actions to take, in what order, using tools and other systems it has been given access to, with a person checking some or none of the steps. The governance change is that the unit of risk stops being a single output and becomes a sequence of actions with consequences.
Lethal Trifecta
Simon Willison's name for the combination of three capabilities that makes an AI agent exploitable for data theft: access to private data, exposure to untrusted content, and the ability to communicate externally. An agent with all three can be made to send private data to an attacker.
Model Context Protocol (MCP)
An open protocol for connecting AI applications to external tools and data through servers that expose tools, resources and prompts. It has become the standard way to give an AI agent access to other systems, which makes its trust model the agent's attack surface: every connected server can steer the model as well as serve it.
OWASP Top 10 for LLM Applications
The OWASP GenAI Security Project's ranked list of the ten most critical security risks in applications built on large language models. The 2026 edition, published in August 2026, is the closest thing the field has to a shared vocabulary for LLM application security, and every item on it maps to an entry in this site's risk register.
Prompt Injection
An attack in which untrusted content reaching a language model is interpreted as instructions rather than data, causing the model to act on an attacker's intent instead of the operator's. It is a property of how the application assembles its context, not a flaw in any particular model.