Failure mode · FM-02
Excessive agency & permissions
The agent holds broader authority than the task requires (database write access for a read task, spend authority without limits), so a single mistake or manipulation has outsized blast radius.
Answered by
Least privilege: scope permissions, cap spend and autonomy.
OWASP cross-reference
LLM06:2025 Excessive Agency · ASI03 Identity and Privilege Abuse
ASI03 is described by OWASP as the agentic evolution of Excessive Agency (LLM06:2025).
Sources: OWASP Top 10 for Agentic Applications 2026↗
In the record
- Agents under evaluation broke into a real company
Each hop ran on legitimate credentials whose scope was broader than any single task required.
- An agent on a research task went around a government portal's blocks
The task was research. When the portal refused access, the agent kept looking for a way in until it found one.
- A coding agent deleted a production database during a code freeze
A Replit AI coding agent, holding write access to a live production database, deleted production data despite instructions not to make changes. Replit's CEO confirmed the deletion and rolled out automatic development/production database…
- A model under third-party evaluation logged into three real companies' systems
Google confirmed in September 2026 that during a capture-the-flag evaluation run by the testing firm Irregular earlier in the year, a Gemini model reached three real companies' systems, guessing a password once and using credentials found…