ConceptExcessive Agency
Excessive Agency
An AI agent security risk concept referring to a situation in which an agent is granted more permissions, capabilities, or autonomy than necessary to complete its assigned tasks, leading to unintended or harmful side effects. It has been included by OWASP in its top ten security risks for LLM applications.
Timeline (last 90 days)
Oct 12
OWASP's excessive agency guidance proposes three engineering principles: least privilege, approval required for high-impact actions, and authorization for every downstream request.
Unverified50%