OWASP LLM08 (2023) Excessive Agency

What is OWASP LLM08 (2023) Excessive Agency?

Excessive agency warned against LLMs making consequential decisions or invoking powerful tools with insufficient human oversight - the bridge from chatbot to operational risk.

What this looks like in production

Retained as LLM06 (2025) and extended by the Agentic Top 10 for multi-step autonomous workflows.

Further reading on Giskard

• OWASP Top 10 for LLM 2023: the original developer checklist
• A Cursor agent wiped a production database in 9 seconds
• Function calling in LLMs: testing agent tool usage

Official OWASP reference