# Excessive Agency — Scope Hijack, Untrusted Code Execution & Unauthorized Privilege Grant (Semantic)

- **Severity:** High
- **Signature ID:** `252d46a3-8e7b-473d-9bb0-f79ef90e37a6`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), ASI03 (Identity and Impersonation), LLM08 (Vector and Embedding Weaknesses)

## Summary

This detects prompts that push an AI agent with real-world tools (messaging, smart devices, code execution, access control) to do more than the user actually intended or has authority to do. It covers three patterns: vague requests that cause the agent to act broadly, requests framed as 'help me debug' that get the agent to run attacker-controlled code, and requests that use the agent as a shortcut to grant access or permissions that should require separate human approval.

## How the attack works

An attacker (or an unwitting user echoing attacker-supplied text) sends the agent a natural-language instruction that sounds reasonable but is either ambiguous ('send this to all subscribed customers', 'turn off all devices') or disguises a malicious payload as a helpful task ('run this script from a GitHub link to fix the crash'). The agent, trying to be helpful, executes with its real tools: messaging systems, smart-home controls, code execution, or access-management APIs. In the privilege-grant variant, the request asks the agent to add a user, unblock a domain, or invite someone to a private resource — bypassing the normal human approval step. The result is the agent performing a consequential, broad, or unauthorized action on the attacker's or an overreaching user's behalf.

## Why it matters

An organization can lose control over what its AI agent does with real permissions: mass messages sent without consent, devices or systems altered beyond intent, malicious code executed under the agent's identity, or unauthorized people or domains granted access — all without a human explicitly approving the specific action.

## What you can do

- Require explicit scoping in agent prompts (named recipients, named devices, named resources) rather than allowing broad or open-ended targets.
- Keep code execution and access-granting tools separated from general-purpose agents, or require a human-in-the-loop approval step before either runs.
- Restrict agents from running code fetched from arbitrary URLs or third-party repos; only allow installs from vetted package sources.
- Log and review agent actions that touch messaging, device control, or identity/access systems, watching for vague or third-party-benefiting requests.

## Known benign look-alikes

- Explicitly scoped communications or device actions (send to named people; turn off one named device)
- Debugging or running the user's own code, or installing from official package managers
- Running well-known official open-source tools
- A user managing or updating their own access or account
- Normal calendar, ticketing, or comment operations without a privilege grant

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01773

---
Source: https://www.netzilo.com/threats/atr-excessive-agency-scope-hijack-untrusted-code-execution-unaut