Indirect injection & excessive agency

Lesson 3 of 8 · 35 min · part of the AI Security Professional certification

Injection becomes dangerous when the model can act: send email, call APIs, run code, move money. An injected instruction in a document can then trigger real actions with the user's permissions.

OWASP calls this Excessive Agency: giving an LLM more functionality, permissions or autonomy than the task requires. Since you cannot fully prevent injection, you must limit the blast radius.

• Least privilege — only the tools and scopes needed (read-only where possible).
• Human-in-the-loop — require explicit user approval for high-impact or irreversible actions.
• Separate trust zones — don't let the same context both read untrusted content and hold sensitive data/tools.
• Authorize in code, not in the prompt — the backend checks permissions for each tool call, regardless of what the model asks for.

Interactive exercise: Design an email assistant's permissions

Interactive exercise: Red-team finding: TripPilot