Agent Security
Excessive Agency
Also: over-permissioned agent
When an AI agent has more tools, permissions or autonomy than its task needs, so any mistake or attack can do outsized damage.
In more detail
OWASP lists excessive agency as a top risk for LLM applications. It shows up as an agent with write access when it only needs read, a token that reaches every repository, or a shell that can run anything without asking. The fix is not a smarter model but a smaller grant: give the agent the narrowest tools, scopes and approvals the job requires.