Excessive agency
When an LLM system has more functionality, permissions or autonomy than its task needs, so that an unexpected or manipulated output turns into a damaging action: running commands, calling APIs or writing to databases beyond what the job required.
OWASP’s 2026 Top 10 for LLM Applications, posted on 3 August and formally announced on 1 September 2026, ranks Excessive Agency third, up from sixth in the 2025 edition. OWASP says the list was tested against thousands of real-world incidents.
It has three causes: too many tools (functionality the task doesn’t need), too much permission (tools with broader access than required) and too much autonomy (high-impact actions with no human check). The 2026 framing for the fix is least agency.
Teams are already reacting. In Stack Overflow’s 2026 pulse survey, 60% of developers block agents from making unapproved system changes.
It’s a prompt-injection problem.
Injection is one trigger. The damage comes from what the agent was allowed to do.
List every tool your agent can call and the permissions behind it. Remove anything the task doesn’t need.
Put a human approval step in front of anything irreversible, and make it part of your design review checklist.