Excessive Agency and the Confused Deputy

The most dangerous LLM risk isn't bad text — it's bad actions. An agent with tools can send emails, move money, run code. Excessive agency is giving it more power than the task needs; the confused deputy is tricking it into misusing the power it has.

#The confused deputy

The agent is a deputy acting with delegated authority. An attacker who can't act directly tricks the trusted agent into acting for them — classically via indirect injection:

attacker → poisons a doc the agent reads → agent (trusted) → uses its email tool → exfiltrates data

The agent had the authority; the attacker supplied the intent.

#Excessive agency = too much trust

#The fix: least privilege + human-in-the-loop

Assume the agent will be hijacked, and design so the blast radius is small. Minimal tools, minimal scopes, confirmations on irreversible actions, and full audit logs.

Related: Indirect Prompt Injection · Agentic Tool-Use Loops · Guardrails and Defense in Depth for LLM Apps