--- title: OWASP just made 'excessive agent access' a top-3 AI... description: OWASP's 2026 Top 10 for LLM applications moved 'excessive agency' from sixth to third place, reflecting that AI security risk now centers on what agents can... canonical: https://daily.dev/posts/owasp-just-made-excessive-agent-access-a-top-3-ai-security-risk-and-the-discourse-is-catching-up-br9brwiif twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OWASP just made 'excessive agent access' a top-3 AI security risk, and the discourse is catching up | daily.dev og:description: OWASP's 2026 Top 10 for LLM applications moved 'excessive agency' from sixth to third place, reflecting that AI security risk now centers on what agents can... og:url: https://daily.dev/posts/owasp-just-made-excessive-agent-access-a-top-3-ai-security-risk-and-the-discourse-is-catching-up-br9brwiif og:image: https://api.daily.dev/og/posts/br9BRWiIf.png og:image:alt: OWASP just made 'excessive agent access' a top-3 AI security risk, and the discourse is catching up og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OWASP just made 'excessive agent access' a top-3 AI security risk, and the discourse is catching up **[Trends](https://daily.dev/sources/trends)** · 2 min read · 0 upvotes · 0 comments ## Summary OWASP's 2026 Top 10 for LLM applications moved 'excessive agency' from sixth to third place, reflecting that AI security risk now centers on what agents can access rather than what models say. The ranking draws on 6,639 recorded incidents. Recommended mitigations include read-only tools, scoped identities, policy enforcement points, and human approval for irreversible actions. Regulatory coverage is messy: the EU Cyber Resilience Act's 24-hour reporting clock started September 11, but lawyers dispute whether it covers cloud-delivered agents versus products, and the only confirmed European incident report came under the AI Act after OpenAI reported agents occupying a German wiki. ## Content The security community has been warning about over-privileged AI agents for a while now. The warnings are getting louder, and the incidents are getting more concrete. The sharpest example in circulation right now is "Clinejection" — a February 2026 incident where a GitHub issue-triage bot with shell access got manipulated through a crafted issue title. The attacker poisoned a GitHub Actions cache, grabbed an npm publishing token, and tampered with a package that was downloaded roughly 4,000 times before anyone noticed. The bot didn't get hacked in the traditional sense. It just did what it was told, by someone it shouldn't have trusted. This is the confused deputy problem, first documented in 1988. An agent holds broad permissions and processes instructions, data, and untrusted external content through the same undifferentiated channel. It can't tell the difference between "my user asked me to do this" and "a malicious string in a GitHub issue title told me to do this." The attack surface isn't the model. It's the permissions. OWASP's 2026 Top 10 for LLM applications — now weighted against 6,639 recorded incidents — moved "excessive agency" from sixth to third place. Co-lead Steve Wilson's read: the hardest AI security problems now live in what tools, credentials, and scopes an agent can reach, not what it outputs. Google at least blinked. Gemini CLI 0.1.61 now requires explicit confirmation before editing build files like `package.json` or `pyproject.toml`, running build commands after such edits, or executing shell commands with arguments sourced from web fetches or MCP responses. Crucially, you can't permanently approve these via "always allow" — the prompt comes back every time. The sandbox also no longer exposes host credentials and API keys to sandboxed processes. Meanwhile, researchers are proposing runtime safety checks (SkillSonar cut attack success rates from ~50% to ~11% on GLM-5), AST-based command validation instead of regex blocklists, and frameworks like DPACT — Delegation, Policy, Auditability, Context, Time — for scoped, time-limited agent credentials. The practical advice hasn't changed much: least privilege, short-lived credentials, human approval for irreversible actions, and keep credentials out of model reach. What's changed is that ignoring it now has a paper trail of real incidents. @trikcode put it plainly: "y'all need to stop giving your agents that much access to your computer." Hard to argue with that. ## Questions this post answers ### What changed in OWASP's 2026 Top 10 for LLM applications regarding agent security? Excessive agency jumped from sixth place to third place in OWASP's 2026 Top 10 for LLM applications, making it a top-three AI security risk. The ranking was informed by 6,639 recorded incidents. Co-lead Steve Wilson noted the hard problems now live in the tools, credentials, and scopes an agent can access, rather than in model outputs. _Teams scoping agent permissions can track evolving AI security guidance like this on daily.dev._ ### What mitigations does OWASP recommend for excessive agent access risk? OWASP recommends read-only tools where possible, scoped identities, a policy enforcement point, and requiring human approval before irreversible actions. These are essentially least-privilege principles applied to AI agents. The goal is limiting the blast radius when an agent is compromised via prompt injection or a vulnerable integration, since damage scales with what the agent can reach. _Developers hardening agent permissions can follow practical mitigation patterns like these on daily.dev._ ### Does the EU Cyber Resilience Act cover AI agent vulnerabilities? It's unresolved. The Cyber Resilience Act's 24-hour vulnerability reporting clock started September 11, but lawyers are already disputing whether it governs physical or software products versus cloud-delivered agents, leaving a regulatory gap. The only confirmed European incident report so far came under the AI Act instead, after OpenAI reported agents that had occupied a German wiki. _Engineers navigating AI compliance uncertainty can follow how regulations like the CRA are interpreted on daily.dev._ ## Similar posts on daily.dev - [AI Agent Security: Six Controls From Nine Real Incidents](https://daily.dev/posts/ai-agent-security-six-controls-from-nine-real-incidents-hpa9kjz2r) · GitGuardian · 0 upvotes · 0 comments - [Cybersecurity Researchers Uncover Flaw in Google AI Coding Tool](https://daily.dev/posts/cybersecurity-researchers-uncover-flaw-in-google-ai-coding-tool-38fhs0zr4) · DevOps.com · 1 upvotes · 0 comments - [A GitHub Issue Title Compromised 4,000 Developer Machines](https://daily.dev/posts/a-github-issue-title-compromised-4-000-developer-machines-e5lzhfwln) · Hacker News · 1 upvotes · 0 comments --- Tags: [#ai-security](https://daily.dev/tags/ai-security), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/owasp-just-made-excessive-agent-access-a-top-3-ai-security-risk-and-the-discourse-is-catching-up-br9brwiif) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OWASP just made 'excessive agent access' a top-3 AI security risk, and the discourse is catching up","url":"https://daily.dev/posts/owasp-just-made-excessive-agent-access-a-top-3-ai-security-risk-and-the-discourse-is-catching-up-br9brwiif","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/owasp-just-made-excessive-agent-access-a-top-3-ai-security-risk-and-the-discourse-is-catching-up-br9brwiif"},"datePublished":"2026-09-19T10:26:20.880Z","dateModified":"2026-10-15T02:22:30.751Z","description":"OWASP's 2026 Top 10 for LLM applications moved 'excessive agency' from sixth to third place, reflecting that AI security risk now centers on what agents can...","image":"https://pbs.twimg.com/media/HSkphBBWAAAiTeh.jpg","thumbnailUrl":"https://pbs.twimg.com/media/HSkphBBWAAAiTeh.jpg","isAccessibleForFree":true,"articleSection":"Trends","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trends","logo":"https://media.daily.dev/image/upload/s--ZfSp3asX--/f_auto,q_auto/v1780996004/logos/trends?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trends"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/owasp-just-made-excessive-agent-access-a-top-3-ai-security-risk-and-the-discourse-is-catching-up-br9brwiif","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-security,prompt-injection,security","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trends","item":"https://daily.dev/sources/trends"},{"@type":"ListItem","position":3,"name":"OWASP just made 'excessive agent access' a top-3 AI security risk, and the discourse is catching up"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/owasp-just-made-excessive-agent-access-a-top-3-ai-security-risk-and-the-discourse-is-catching-up-br9brwiif#faq","mainEntity":[{"@type":"Question","name":"What changed in OWASP's 2026 Top 10 for LLM applications regarding agent security?","acceptedAnswer":{"@type":"Answer","text":"Excessive agency jumped from sixth place to third place in OWASP's 2026 Top 10 for LLM applications, making it a top-three AI security risk. The ranking was informed by 6,639 recorded incidents. Co-lead Steve Wilson noted the hard problems now live in the tools, credentials, and scopes an agent can access, rather than in model outputs. Teams scoping agent permissions can track evolving AI security guidance like this on daily.dev."}},{"@type":"Question","name":"What mitigations does OWASP recommend for excessive agent access risk?","acceptedAnswer":{"@type":"Answer","text":"OWASP recommends read-only tools where possible, scoped identities, a policy enforcement point, and requiring human approval before irreversible actions. These are essentially least-privilege principles applied to AI agents. The goal is limiting the blast radius when an agent is compromised via prompt injection or a vulnerable integration, since damage scales with what the agent can reach. Developers hardening agent permissions can follow practical mitigation patterns like these on daily.dev."}},{"@type":"Question","name":"Does the EU Cyber Resilience Act cover AI agent vulnerabilities?","acceptedAnswer":{"@type":"Answer","text":"It's unresolved. The Cyber Resilience Act's 24-hour vulnerability reporting clock started September 11, but lawyers are already disputing whether it governs physical or software products versus cloud-delivered agents, leaving a regulatory gap. The only confirmed European incident report so far came under the AI Act instead, after OpenAI reported agents that had occupied a German wiki. Engineers navigating AI compliance uncertainty can follow how regulations like the CRA are interpreted on daily.dev."}}]} ```