Pick the clearest example of LLM08 excessive agency

Attempt it

**LLM08, excessive agency** is the OWASP LLM Top 10 item that names a specific failure pattern: an agent has been granted more capability than the task strictly requires, and a prompt injection (LLM01) then weaponises the extra capability to cause harm the task itself would never have produced. The canonical example in the question hits the pattern exactly. A **summarisation agent** has a task that only requires reading inbox content. Read access is enough. The developer also wired up `send_email`, perhaps as a convenience, perhaps because the framework template included it, perhaps because the agent might one day want to reply. The day an attacker plants an injection inside one of the inbox messages, the model reads the injection as part of summarising, follows the embedded instruction, and uses `send_email` to exfiltrate the user's data to an attacker-controlled address. The other options are different OWASP items or different failure modes. Slow responses under load are LLM04 (denial of service). Occasional hallucination is LLM09 (overreliance). Over-refusal of benign requests is a refusal-calibration failure, not in the Top 10 directly. The defence is the principle of least privilege applied to tool registries. Audit each tool against the task; remove any capability the task does not need; default to read-only access; require explicit user confirmation for write-class tools.

**LLM08, excessive agency, is the OWASP item that names the gap between task requirements and granted capability.** When the gap is positive (agent has more power than the task needs), a prompt injection that succeeds against the model becomes an exfiltration or destructive channel through the extra capability. The injection itself is LLM01; LLM08 is the architectural condition that made the injection harmful instead of harmless. **The canonical example in the question.** The summarisation task requires read access to inboxes. The agent was given read access plus `send_email`. An attacker plants an injection inside an inbox message; the summariser reads it as part of normal comprehension; the model follows the embedded instruction and invokes `send_email` to send the user's data to an attacker-controlled address. The summariser produced harm the summariser was never asked to produce. **Why this is its own category rather than just 'be careful with tools'.** LLM08 is structural. It is about the choices made at agent design time, which tools to register, what permission scope to grant, what blast radius each tool has. These decisions are made before any prompt is written and survive every model upgrade. Even a perfectly aligned model that always refuses obvious injections is still vulnerable to subtle indirect injection if the underlying capability is excessive. **The three defences in order.** Least-privilege tool registry: every tool registered must justify itself against the task; remove any that does not. Capability gating: write-class tools require an explicit user confirmation or human in the loop signoff for irreversible operations. Argument validation: even for granted tools, the per-argument policy (recipient-domain allowlists, refund caps) bounds what the granted capability can be asked to do. These three layers together close LLM08 to a residual that the rest of the safety stack can handle.

Quick reference

TL;DR

LLM08 excessive agency is the failure mode where the agent has more capability than the task needs, and an injection then weaponises the extra capability. Summariser with send_email is the canonical example.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Picture hiring an intern to read your mail and write a daily summary. That job needs read access. If you also hand them a stack of pre-signed letterhead and a fax machine for sending wire transfers, you have given them more power than the role needs. Most days nothing bad happens. The day a forged note slips into your inbox saying 'send fifty thousand dollars to account X,' the intern reads it as part of the job and faxes it. Excessive agency is that exact mismatch: capability the task did not require, sitting there waiting for an injection to weaponise.

Key concepts

Safety and guardrails

Detailed answer & concept explanation

~8 min read

Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.

Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example.

Sign in for 5 free unlocks/day or go Pro for unlimited. See Pro pricing.

Quick scan · 2–4 min

Everything important, quickly.

3 min: definition of LLM08 and how it differs from LLM01; the three axes (functionality, permissions, autonomy); how injection becomes harmful through excessive agency; the defence stack (least-privilege, scoping, confirmation gates); 2026 tooling and framework patterns.

Real-world examples

Real products, models, and research that use this idea.

OWASP LLM Top 10 documentation explicitly names the summariser with send email pattern as a canonical LLM08 example.
Microsoft Copilot for Microsoft 365 in 2026 enforces capability scoping by Graph API permission and requires explicit user confirmation for write-class operations on Teams and SharePoint content.
Anthropic's Claude tool-use docs and the Anthropic Cookbook in 2026 recommend least-privilege tool registries plus explicit user confirmation for irreversible operations as the LLM08 mitigation pattern.
AWS Bedrock AgentCore and AgentCore for Bedrock add policy layers around agent action selection that allow administrators to express LLM08 constraints (tool scope, permission tier, confirmation requirement) declaratively.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QHow would you design an LLM08 audit checklist for a new agent at design time?

Sign in or go Pro to see the approach for this follow-up.

QWhere does excessive autonomy show up in agent flows besides tool registration, and how do you mitigate it?

Sign in or go Pro to see the approach for this follow-up.

QHow does Anthropic's Claude tool-use API help mitigate LLM08 by design, and where does it leave the application developer responsible?

Sign in or go Pro to see the approach for this follow-up.

Don't say this

Red flags and common mistakes that signal junior thinking. Click to expand.

Most common mistake

Confusing LLM08 (capability mismatch, agent has more power than task needs) with LLM04 (denial of service), LLM09 (overreliance on model output), or general jailbreak. LLM08 is specifically about the power to task gap.

Sign in or go Pro to see all red flags and common mistakes. See Pro pricing.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.