OWASP Top 10 for LLM Applications, 2025
LLM06: Excessive Agency
Excessive agency is the risk that a model-driven application takes a damaging action because it was given too much functionality, too many permissions or too much autonomy. LLM applications are often given tools, skills or plugins to call functions and external systems, and sometimes an agent decides which one to use.
Excessive Agency in more detail
When the model's output is unexpected, ambiguous or manipulated, the action still happens. OWASP names hallucination, poor model performance and direct or indirect prompt injection, including from compromised extensions or peer agents, as triggers. The impact can touch confidentiality, integrity and availability, depending on what the application can reach. It differs from improper output handling, which is about weak scrutiny of the output itself. The fix is mostly design: fewer tools, narrower permissions and a human in the loop for high-impact actions.
The risk and its name come from OWASP; the summary, examples and controls on this page are our plain-English reading of OWASP's page. Source: Source, checked October 21, 2026: genai.owasp.org (opens in a new tab)
How it shows up
- A document tool meant to be read-only also includes modify and delete functions.
- A trial extension stays available after it was replaced.
- A tool meant to run one command can run any command.
- A read-only task uses a database identity that can also insert, update and delete.
- Documents are deleted without asking the user to confirm.
Controls that reduce it
- Minimize the extensions an agent can call, and limit each one to the functions it needs.
- Prefer granular tools over open-ended ones such as a shell or a URL fetcher.
- Grant downstream permissions at the minimum level, for example read-only database access.
- Run actions in the user's own context, using OAuth with minimal scopes.
- Require human approval for high-impact actions.
- Enforce authorization in the downstream systems instead of trusting the model.
Controls reduce risk, they do not remove it
No single control covers excessive agency on its own. Combine controls, and treat any tool as one layer.
Categories that address it
Our analysisThese are the directory categories whose tools we score on this risk. The mapping is our analysis.
Layers that address this risk
Our AI security layers are an editorial model, not a standard. Source states means OWASP's own text for LLM06 names the control the layer delivers. Our analysis means we drew the link.
- L1 Governance and risk Our analysis
- L2 Discovery and posture Our analysis
- L4 Testing and red teaming Our analysis
- L7 Agent and tool access Source states
Tools mapped to LLM06
Our analysis51 tools are mapped. Each tool is mapped only where a documented capability supports it. Open a tool page to see the capability and its source. Coverage Score compares tools within one category.
| Tool | Type | Deployment | Pricing model | OWASP risks | Coverage Score | Last reviewed |
|---|---|---|---|---|---|---|
| DefenseClawCisco · Agent security | Open sourceApache-2.0 |
| Free |
| 76 out of 100 | |
| NeMo GuardrailsNVIDIA · Guardrails | Open sourceApache-2.0 |
| Free |
| 76 out of 100 | |
| Docker MCP GatewayDocker · Agent security | Open sourceMIT |
| Free |
| 72 out of 100 | |
| agentgatewayagentgateway (a Series of LF Projects, LLC) · Agent security | Open sourceApache-2.0 |
| Free |
| 69 out of 100 | |
| NeuralTrustNeuralTrust · Agent security | Open sourceApache-2.0 |
| Freemium |
| 68 out of 100 | |
| ContextForgeIBM · Agent security | Open sourceApache-2.0 |
| Free |
| 64 out of 100 | |
| OpenShellNVIDIA · Agent security | Open sourceApache-2.0 |
| Free |
| 64 out of 100 | |
| Evo AI-SPMSnyk · AI-SPM | Commercial |
| Usage-based |
| 64 out of 100 | |
| Strands BoxAmazon Web Services · Agent security | Open sourceApache-2.0 |
| Free |
| 64 out of 100 | |
| AktoAkto · Agent security | Open sourceMIT |
| Contact sales |
| 63 out of 100 | |
| MCP-ScanSnyk (Invariant Labs) · Agent security Now Snyk Agent Scan | Open sourceApache-2.0 |
| Not published |
| 63 out of 100 | |
| Agent Governance ToolkitMicrosoft · Agent security | Open sourceMIT |
| Free |
| 63 out of 100 | |
| Uber ADRUber · Agent security | Open sourceApache-2.0 |
| Free |
| 59 out of 100 | |
| Granite GuardianIBM · Guardrails | Open sourceApache-2.0 |
| Free |
| 57 out of 100 | |
| Lakera GuardCheck Point (Lakera) · Guardrails Now Check Point AI Guardrails | Commercial |
| Not published |
| 57 out of 100 | |
| Llama ProtectionsMeta · Guardrails | Open, custom license |
| Free |
| 56 out of 100 | |
| AgentCore PolicyAmazon Web Services · Agent security | Commercial |
| Usage-based |
| 55 out of 100 | |
| Azure AI Content SafetyMicrosoft · Guardrails Renamed | Commercial |
| Freemium |
| 55 out of 100 | |
| Holistic AIHolistic AI · Governance | Commercial |
| Not published |
| 55 out of 100 | |
| Credo AICredo AI · Governance | Commercial |
| Not published |
| 54 out of 100 | |
| Invariant GuardrailsSnyk (Invariant Labs) · Agent security | Open sourceApache-2.0 |
| Free |
| 54 out of 100 | |
| Wiz AI-SPMGoogle (Wiz) · AI-SPM | Commercial |
| Not published |
| 54 out of 100 | |
| AI Red Teaming AgentMicrosoft · Red teaming | Commercial |
| Usage-based |
| 53 out of 100 | |
| b3 benchmarkCheck Point (Lakera) and UK AI Security Institute · Red teaming | Open sourceMIT |
| Free |
| 53 out of 100 | |
| Noma SecurityNoma Security · AI-SPM | Commercial |
| Not published |
| 53 out of 100 | |
| Gray SwanGray Swan · Red teaming | Commercial |
| Not published |
| 52 out of 100 | |
| HarmonicHarmonic Security · Data protection | Commercial |
| Not published |
| 52 out of 100 | |
| Kubernetes Agent SandboxKubernetes SIG Apps · Agent security | Open sourceApache-2.0 |
| Free |
| 52 out of 100 | |
| Adversa AIAdversa AI · Red teaming | Commercial |
| Not published |
| 50 out of 100 | |
| Agent GatewayGoogle Cloud · Agent security | Commercial |
| Not published |
| 50 out of 100 | |
| StraikerStraiker · Agent security | Commercial |
| Not published |
| 49 out of 100 | |
| Zscaler AI-SPMZscaler · AI-SPM | Commercial |
| Not published |
| 49 out of 100 | |
| Pangea AI GuardCrowdStrike (Pangea) · Guardrails | Commercial |
| Not published |
| 48 out of 100 | |
| Pillar SecurityPillar Security · Agent security | Commercial |
| Not published |
| 48 out of 100 | |
| Cisco AI DefenseCisco · Guardrails | Commercial |
| Not published |
| 47 out of 100 | |
| OneTrust AI GovernanceOneTrust · Governance | Commercial |
| Contact sales |
| 46 out of 100 | |
| Lakera RedCheck Point (Lakera) · Red teaming | Commercial |
| Contact sales |
| 45 out of 100 | |
| NightfallNightfall · Data protection | Commercial |
| Contact sales |
| 45 out of 100 | |
| SaidotSaidot · Governance | Commercial |
| Not published |
| 42 out of 100 | |
| Operant AIOperant AI · Agent security | Commercial |
| Not published |
| 39 out of 100 | |
| MCP Server PortalsCloudflare · Agent security | Commercial |
| Not published |
| 38 out of 100 | |
| HiddenLayer AIDRHiddenLayer · Guardrails | Commercial |
| Not published |
| 37 out of 100 | |
| WitnessAIWitnessAI · Data protection | Commercial |
| Not published |
| 36 out of 100 | |
| ZenityZenity · Agent security | Commercial |
| Not published |
| 35 out of 100 | |
| Oasis SecurityCyera (Oasis Security) · Agent security | Commercial |
| Not published |
| 34 out of 100 | |
| Astrix AI Agent SecurityCisco (Astrix Security) · Agent security | Commercial |
| Not published |
| 33 out of 100 | |
| CalypsoAIF5 (CalypsoAI) · Guardrails Now F5 AI Guardrails | Commercial |
| Not published |
| 32 out of 100 | |
| Falcon GuardianCrowdStrike · Agent security | Commercial |
| Not published |
| 31 out of 100 | |
| Repello AIRepello AI · Red teaming | Commercial |
| Not published |
| 31 out of 100 | |
| Prompt SecuritySentinelOne (Prompt Security) · Guardrails | Commercial |
| Not published |
| 29 out of 100 | |
| Veza AI Agent SecurityServiceNow (Veza) · Agent security | Commercial |
| Not published |
| 29 out of 100 |
No tools match these filters. Clear a filter to see more.
Why each tool is mapped
- DefenseClaw: Blocks or asks a person to approve risky tool calls, and can run an agent in a sandbox.
- NeMo Guardrails: Execution rails validate the inputs and outputs of tool calls.
- Docker MCP Gateway: Servers and tools can be limited per gateway run or profile, so a client reaches only the tools you enable.
- agentgateway: CEL rules limit which MCP tools a client can use, and guardrails can deny tool calls before they reach the backend.
- NeuralTrust: Scopes tool access per agent and per user and records every tool call through the gateway.
- ContextForge: Role-based access control and tool authorization on virtual servers limit which tools a client can reach.
- OpenShell: Sandbox isolation and YAML policies limit which files, processes and network destinations an agent can use.
- Evo AI-SPM: Unauthorized tool use and destructive actions are test goals that Snyk maps to LLM06.
- Strands Box: Default-deny rules and OS isolation limit what files, programs and network destinations an agent can use.
- Akto: Finds agents and MCP servers and probes them for tool abuse and privilege escalation.
- MCP-Scan: Reports a destructive capabilities risk indicator for the MCP servers an agent can call.
- Agent Governance Toolkit: The policy engine checks each agent action before it runs, which limits what an agent can do.
- Uber ADR: Inventories agents and records their tool calls and permissions so over-broad or unsafe actions can be reviewed after the fact.
- Granite Guardian: Function-calling hallucination checks flag tool calls with wrong names, arguments or types.
- Lakera Guard: A tool allow and deny list limits which tools an agent can call.
- Llama Protections: AlignmentCheck audits agent reasoning to flag goal hijacking.
- AgentCore Policy: Default-deny rules by caller identity and tool input values limit which tool calls an agent can make.
- Azure AI Content Safety: The task adherence API flags misaligned or premature agent tool use.
- Holistic AI: Operative agents can control agent tool calls, access and cost under custom policies.
- Credo AI: The risk and control library for agents covers tool misuse and scope drift.
- Invariant Guardrails: Rules can block tool calls and tool-call sequences that an agent should not make.
- Wiz AI-SPM: The page lists runtime protection against rogue agents.
- AI Red Teaming Agent: Tests whether an agent performs prohibited, high-risk or irreversible actions.
- b3 benchmark: Includes direct and indirect tool invocation attacks against the agent's model.
- Noma Security: Flags excessive agency and sets a baseline of allowed agents, MCP servers and skills, with approve or block decisions on tool calls.
- Gray Swan: The managed service covers tool exploitation against agent deployments.
- Harmonic: The local MCP gateway allows or blocks MCP servers and single tools, which limits what an agent can do.
- Kubernetes Agent Sandbox: Runtime isolation and default network rules limit what an agent workload can reach if it runs untrusted code.
- Adversa AI: Tests agents for tool hijack and goal manipulation, and MCP servers for tool misuse and privilege escalation.
- Agent Gateway: Default-deny access policies tied to agent identity and plain-language rules limit what tools agents can reach and use.
- Straiker: Blocks risky tool access and flags malicious or vulnerable MCP servers.
- Zscaler AI-SPM: Flags access risk and misconfigurations in AI agents, the excess permissions behind excessive agency.
- Pangea AI Guard: Tool input and output recipes screen what an agent sends to tools and gets back; they do not limit which tools it may call.
- Pillar Security: Scans agent permissions and flags excessive permissions.
- Cisco AI Defense: Tool allowlists and blocklists apply to MCP traffic.
- OneTrust AI Governance: Agents are registered with a defined purpose and their permissions are enforced by policy.
- Lakera Red: Covers tool-using agents and tests for unauthorized actions.
- Nightfall: The MCP Gateway enforces policy on each tool call and blocks unapproved MCP servers by default.
- Saidot: The Agent Catalogue records each agent's purpose, lineage and autonomy level.
- Operant AI: MCP allow and deny lists and access controls limit what agents can reach.
- MCP Server Portals: Tool and prompt allowlists and Access policies limit which MCP servers and tools users and agents can reach.
- HiddenLayer AIDR: Detects unauthorized agent behavior and malicious tool use.
- WitnessAI: Control enforces approved MCP servers and tools for employees and agents.
- Zenity: Runtime Boundaries can block agent actions, and posture checks review agent permissions.
- Oasis Security: Runs agents on short-lived, least-privilege identities with time-bound access.
- Astrix AI Agent Security: Finds agents with excessive privileges and issues short-lived, scoped credentials.
- CalypsoAI: Guardrails on agent actions and tool use limit excessive agency.
- Falcon Guardian: Finds agents, sets which may run on managed endpoints and detects malicious agent behavior at runtime.
- Repello AI: The product page says it discovers and validates multi-stage exploit chains in AI agents.
- Prompt Security: Agent access and actions are governed with least-privilege scope.
- Veza AI Agent Security: Maps what each agent can reach and removes excessive permissions to enforce least privilege.