The most dangerous LLM risk isn't bad text — it's bad actions. An agent with tools can send emails, move money, run code. Excessive agency is giving it more power than the task needs; the confused deputy is tricking it into misusing the power it has.
The confused deputy
The agent is a deputy acting with delegated authority. An attacker who can't act directly tricks the trusted agent into acting for them — classically via indirect injection:
attacker → poisons a doc the agent reads → agent (trusted) → uses its email tool → exfiltrates dataThe agent had the authority; the attacker supplied the intent.
Excessive agency = too much trust
| Over-grant | Safer |
|---|---|
| Tool can send to any address | Allow-listed recipients |
| Agent has write DB access | Read-only unless needed |
| Acts autonomously on money | Human confirms high-impact actions |
The fix: least privilege + human-in-the-loop
Assume the agent will be hijacked, and design so the blast radius is small. Minimal tools, minimal scopes, confirmations on irreversible actions, and full audit logs.
Related: Indirect Prompt Injection · Agentic Tool-Use Loops · Guardrails and Defense in Depth for LLM Apps