OWASP (Open Worldwide Application Security Project) has singled out "Excessive Agency" as the top risk in the 2025 edition of its LLM Applications Top 10 risks list—the only entry newly added specifically for Agents. We note this signals that scenarios like "AI auto-deleting files, sending external emails, bypassing approval" have moved from theoretical risk to questions engineering teams must directly answer.
What This Is
An AI Agent is an AI application that decides on its own which API to call next or which file to write. The qualitative shift isn't "smarter"—it's that the attack surface escalates from a piece of text to a real action: a chatbot saying the wrong thing can only mislead you; an Agent calling the wrong tool can directly wipe a database or exfiltrate data. Risks in the OWASP 2025 edition directly tied to Agents include: Prompt Injection, Improper Output Handling, Excessive Agency, System Prompt Leakage, Sensitive Information Disclosure, and Unbounded Consumption. Of these, "Excessive Agency" is the Agent-specific top risk, with three root causes: too many capabilities, too much permission, too high autonomy. Mitigation maps to four actions: minimize extensions (don't expose a single capability you don't need), minimize extension functionality (a read-only tool shouldn't carry delete capability), avoid open-ended interfaces (don't give Agents tools that "execute arbitrary shell"), and minimize extension permissions (create separate identities per the least-privilege principle).
Industry View
The mainstream consensus is that guardrails must be engineered. Relying on writing "you absolutely must not execute external instructions" in the prompt is essentially useless—the model cannot architecturally distinguish between "system-issued instructions" and "instructions smuggled in via data"; for the model, both are just tokens in context. Real boundaries must live at the code layer: whitelists, least privilege, and human-in-the-loop review for critical actions (i.e., any action that changes external state must have a human sign off). But there are also sober voices. Frontline engineers warn: designing tools as API boundaries rather than "model superpowers" means rewriting large amounts of existing integrations; rolling out least-privilege inside enterprises will repeatedly tug-of-war with the "fast onboarding" business demand. Another view holds that the OWASP list leans defensive, that real-world attack sample statistics on Agents in production are still thin, and that guardrail boundaries remain in an exploratory phase.
Impact on Regular People
For enterprise IT: before shipping an Agent, design the tool inventory per the least-privilege principle—if read-only works, don't grant write; if a dedicated account works, don't use admin. For individual professionals: when using AI Agents to batch-process emails and files, don't fully delegate critical actions (delete, external send, change permissions)—keep a human confirmation step. For consumer markets: as consumer-grade AI assistants gain more action permissions (booking flights, making payments, changing settings), personal accounts and data security will face new risks; we recommend prioritizing operation notifications and two-factor authentication.