Analysis
LLM06 - Excessive Agency. This is the seventh article in the… | by Erdemstar | Aug, 2026 | Medium
Publication date not yet evaluated · Added · 9 reports medium.com
Page published · Page updated
Coverage timeline
Why it matters
Excessive Agency is a core driver of real agentic-AI compromises like EchoLeak, and understanding how over-privileged agents turn indirect prompt injection into concrete action helps defenders scope permissions and sandbox tool execution.
An explainer article on OWASP's LLM06 'Excessive Agency' describes how AI agents are commonly over-provisioned with broad permissions, tools, and autonomy, making them dangerous when they encounter untrusted content such as emails or documents that embed instructions. The piece illustrates the risk through indirect prompt injection and cites EchoLeak (CVE-2025-32711), the zero-click Microsoft 365 Copilot exploit, recommending separation of reasoning from execution, short-lived scoped tokens, and sandboxing.
Summary
This guidance analysis examines OWASP's Excessive Agency risk: AI agents are routinely granted broader permissions than their tasks require because developers favor speed over scoping, cannot predetermine an agent's runtime tool-calling order, and are constrained by coarse legacy API permission models. OWASP breaks the root cause into excessive functionality, excessive permissions, and excessive autonomy.[0]
Over-privileged agents become dangerous when a single channel carries both instructions and content, letting embedded instructions in untrusted documents or emails be treated as commands. The EchoLeak vulnerability (CVE-2025-32711) in Microsoft 365 Copilot is the concrete example: a zero-click, remote, unauthenticated prompt injection that exfiltrated data via a single crafted email, achieved by chaining bypasses of Microsoft's XPIA classifier, link redaction, auto-fetched images, and a Teams proxy allowed by the content security policy.[0][50]
The analysis frames indirect prompt injection as a fundamental, high-severity problem because LLMs do not enforce a boundary between instructions and data, so it cannot be mitigated like SQL injection and confused-deputy manipulation of agent tool access can occur without user interaction. The concern is now formalized: OWASP's 2026 GenAI LLM Top 10 elevated Excessive Agency from LLM06 to LLM03, the biggest movement in the ranking. Recommended remediation centers on least privilege: separating reasoning from execution, using short-lived task-scoped tokens, and sandboxing code/file-handling tools.[0][13][53]
Disclosure timeline
| Date | Event |
|---|---|
| January 2025 | Researchers at Aim Labs created a working proof of concept for the zero-click prompt injection vulnerability in Microsoft 365 Copilot and reported it privately to Microsoft's Security Response Centre.[0] |
| May 2025 | Microsoft rolled out a server-side fix for the EchoLeak flaw.[0] |
| June 2025 | Microsoft published the EchoLeak advisory (CVE-2025-32711); Aim Security publicly disclosed the vulnerability.[0][50] |
How it works
Excessive Agency manifests when a single data channel carries both instructions and content, so an over-permissioned agent cannot distinguish an attacker's embedded instruction (e.g. 'Delete all logs from the server' inside an email) from text it was merely asked to summarize; if the model interprets it as a command and holds the API permission to act, the action executes without further checks.[0]
Indirect prompt injection is fundamentally distinct from classic injection because current LLMs do not enforce a security boundary between instructions and data inside a prompt — untrusted content concatenated with developer instructions can be executed as instructions, which is why it cannot be mitigated the same way as SQL injection.[0][53]
EchoLeak achieved full privilege escalation across LLM trust boundaries without user interaction by chaining multiple bypasses: evading Microsoft's XPIA (Cross Prompt Injection Attempt) classifier, circumventing link redaction with reference-style Markdown, exploiting auto-fetched images, and abusing a Microsoft Teams proxy permitted by the content security policy to exfiltrate internal file contents to an attacker-controlled server.[50]
Confused-deputy exploitation at the tool/plugin level was demonstrated earlier by Cross Plugin Request Forgery in ChatGPT, where malicious instructions hosted on a webpage caused the agent to automatically invoke another plugin — and, with a privileged plugin such as Zapier, take actions on behalf of the user — purely because text on the page said so.[27]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Microsoft 365 Copilot | Versions vulnerable to EchoLeak (CVE-2025-32711), a zero-click prompt injection enabling remote, unauthenticated data exfiltration via a single crafted email. | Microsoft rolled out a server-side fix (reported by May 2025) and published an advisory in June 2025; Microsoft stated no evidence of real-world exploitation.[0][50] |
Key takeaways
- Excessive Agency is largely a design choice: scoping permissions, tokens, and autonomy into the agent architecture from the start turns most OWASP-listed risks into avoided incidents rather than latent ones.[0]
- EchoLeak (CVE-2025-32711) proved that indirect prompt injection against a widely used production LLM agent is a practical, high-severity vulnerability class, not a hypothetical one, even absent confirmed real-world exploitation.[0][50]
- Because LLMs enforce no instruction/data boundary, prompt injection cannot be mitigated like SQL injection and must be countered with least privilege, isolation, and independent verification of significant actions.[0][53]
- The rising importance of agent capability is reflected in OWASP's 2026 GenAI LLM Top 10, where Excessive Agency jumped from LLM06 to LLM03 — its biggest movement — as agents gain access to more tools, APIs, and business systems.[13]
Defensive actions
- Separate the reasoning engine from the execution engine and require an independent policy check or human approval before high-risk actions (deletion, fund transfer, production changes, external data sending).: Prevents the model's judgment alone from authorizing impactful tool calls, addressing OWASP's excessive-autonomy root cause.[0]
- Replace permanent API keys with short-lived, task-scoped tokens (e.g. a token limited to one document ID that expires when the task completes).: Enforces least privilege, preventing an agent from reaching an entire drive, workspace, or database when it only needs one record.[0]
- Sandbox any agent-generated code or file-handling tools in temporary, network-restricted containers.: Contains manipulation or compromise and limits lateral movement rather than assuming compromise won't occur.[0]
- Test agents with a basic indirect prompt-injection payload, such as a document containing an embedded instruction, before deploying mitigations.: Validates whether the agent treats embedded instructions as commands, exposing Excessive Agency risk prior to production.[0]
- Apply defense-in-depth mitigations derived from EchoLeak analysis: prompt partitioning, enhanced input/output filtering, provenance-based access control, and strict content security policies.: Multiple bypasses defeated single defenses in EchoLeak, so layered controls and continuous adversarial testing are required for production copilots.[50]