Your Agent Has Too Much Authority: The Excessive-Agency Problem Won't Fix Itself

Every tool-connected model is a little more than a chatbot. Give it a shell, a database, or a file system, and it stops reading your words and starts acting on them. That agency is the whole appeal of agentic AI — and it is also the thing that will bite you hardest if you leave it unsupervised.

Security people have a name for the failure mode: excessive agency. OWASP pinned it as LLM06 back in its 2025 Top 10 for LLM Applications, and the description has aged well. The root cause is usually one of three things: you gave the model a tool that can do too much, you gave it permissions broader than the task needs, or you let it act with no human review. When a bad prompt — injected, hallucinated, or just badly written — meets that setup, the agent does something real. Not a bad answer. A bad action.

That was the worry two years ago. By now, the worry has matured into a dedicated checklist.

OWASP now treats agents as a category of their own. The Top 10 for Agentic Applications 2026 joins the LLM list, and it reads like a catalog of the ways a system with fingers can hurt you: Agent Goal Hijack (ASI01), Tool Misuse (ASI02), Identity & Privilege Abuse (ASI03), Agentic Supply Chain Compromise (ASI04), and Memory & Context Poisoning (ASI06) among them. What changed is the shift in emphasis. A plain LLM can be tricked; an agent with tools can be weaponized. The 2025 list scored a document-reading extension that also happens to send email as a textbook case. The 2026 list asks harder questions: whose credentials is the agent acting on, and does anyone check what it actually decided to do?

The evidence that these aren't theoretical fears keeps piling up. A study of the Model Context Protocol ecosystem (arXiv:2510.16558, accepted to DSN 2026) pulled 67,057 MCP servers from six public registries and found that 833 contained exploitable vulnerabilities, with 18 carrying suspicious tool descriptions. The researchers also found that MCP hosts typically don't verify the tools the model chooses to call — the model's own judgment is the main gate before a tool runs. Redirection hijacking alone looked reachable in 304 servers. This is the supply chain problem from ASI04 made concrete: you didn't author that file-sharing integration; you trusted a registry listing for it.

The pattern repeats across the mainstream agent tooling. Public vulnerability disclosures in 2026 include sandbox escapes and privilege-escalation bugs in popular coding assistants (tracked as CVE-2026-25725 and CVE-2026-35603) — flaws in tools that thousands of devs run against their real repos every day. None of these required breaking a model. They abused ordinary features: a file-write tool, an executable-search path, a startup hook.

So what should you actually do? The mitigations are mostly the boring ones you already know, applied with new discipline:

• Least privilege, enforced downstream. Don't rely on the model to decide what it's allowed to do. The database, the file system, and the API should check permissions on every call — the same "complete mediation" rule from ordinary app security.
• Scope credentials. Ask yourself which human the agent is acting for. When possible, run its calls in that user's context with the minimum scope, rather than through a privileged service account.
• Cut the tool list. Every extension you add is a new way in. Remove the ones you don't need for the task, and prefer narrow tools over open-ended ones like "run a shell command."
• Keep a human on the dangerous steps. Deleting records, sending mail, posting code — these deserve confirmation, and they deserve logging either way.

The uncomfortable truth is that giving a model agency is the easy part. Containing it is the real engineering. OWASP's new lists and the MCP audit are useful reading precisely because they translate that discomfort into something you can grep for. Your agent is powerful. Make sure the power is the tool's, not the attacker's. excerpt: "AI agents that act on your systems can be weaponized when over-privileged. OWASP's 2026 rankings and a sweeping MCP audit explain the fix." The pattern repeats across the mainstream agent tooling. Public vulnerability disclosures in 2026 include sandbox escapes and privilege-escalation bugs in popular coding assistants, including CVE-2026-25725 and CVE-2026-35603 — flaws in tools that thousands of devs run against their real repos every day. None of these required breaking a model. They abused ordinary features: a file-write tool, an executable-search path, a startup hook. The evidence that these aren't theoretical fears keeps piling up. A study of the Model Context Protocol ecosystem (arXiv:2510.16558, accepted to DSN 2026) pulled 67,057 MCP servers from six public registries and found that 833 contained exploitable vulnerabilities, with 18 carrying suspicious tool descriptions. The researchers also found that MCP hosts typically don't verify the tools the model chooses to call, so the model's own judgment is the only gate before a tool runs. Redirection hijacking alone looked reachable in 304 servers. This is the supply chain problem from ASI04 made concrete: you didn't author that file-sharing integration; you trusted a registry listing for it. So what should you do? The mitigations are mostly the boring ones you already know, applied with new discipline: OWASP now treats agents as a category of their own. The Top 10 for Agentic Applications 2026 joins the LLM list, and it reads like a catalog of the ways a system with fingers can hurt you: Agent Goal Hijack (ASI01), Tool Misuse (ASI02), Identity & Privilege Abuse (ASI03), Agentic Supply Chain Compromise (ASI04), and Memory & Context Poisoning (ASI06). The emphasis has shifted. A plain LLM can be tricked; an agent with tools can be weaponized. The 2025 list scored a document-reading extension that also happens to send email as a textbook case. The 2026 list asks harder questions: whose credentials is the agent acting on, and does anyone check what it actually decided to do? The evidence that these aren't theoretical fears keeps piling up. A study of the Model Context Protocol ecosystem (arXiv:2510.16558, accepted to DSN 2026) pulled 67,057 MCP servers from six public registries and found that 833 contained exploitable vulnerabilities, with 18 carrying suspicious tool descriptions. The researchers also found that MCP hosts typically don't verify the tools the model chooses to call, so the model's own judgment is the only gate before a tool runs. Redirection hijacking alone looked reachable in 304 servers. This is ASI04, the supply chain problem, made concrete: you didn't author that file-sharing integration; you trusted a registry listing for it. Security people have a name for the failure mode: excessive agency. OWASP pinned it as LLM06 in its 2025 Top 10 for LLM Applications. The root cause is usually one of three things: you gave the model a tool that can do too much, you gave it permissions broader than the task needs, or you let it act with no human review. When a bad prompt — injected, hallucinated, or just badly written — meets that setup, the agent does something real. Not a bad answer. A bad action.