LLM06: Excessive Agency
Tools and plugins granted to an agent exceed the principle of least privilege.
Last reviewed October 2026
Why LLM06 evidence is hard
Least privilege is easy to state and hard to evidence, because the tool list an agent holds is longer than the one it needs. The probes that actually exercise it - account modification, mass email, an irreversible delete, a purchase - are filed under an older identifier, and of the 504 templates carrying LLM06 here, 459 are harmful-content refusal tests left from the 2023 list. Read the coverage figure accordingly. Anything with a real-world effect is withheld on a read-only endpoint and reported as withheld, never as a pass.
How Penaxtra maps to LLM06
The LLM06 identifier is written onto the finding at the moment it is created, not mapped in afterwards, so the JSON and PDF exports come out already in your assessor's structure. Every finding carries the probe that was sent, a SHA-256 digest of the response it provoked, the tier that decided the verdict and its status history from first observation to close. Identity survives a re-scan: a control you closed and that comes back reopens under the same row with a reopen count, rather than arriving as a new issue.
LLM06 capabilities
Findings tagged with the OWASP LLM Top 10 LLM06 identifier
Penaxtra severity for this control (critical)
Cross-framework identifiers attached to the same finding where controls overlap
PDF and JSON evidence export with the control identifier attached
LLM06 control coverage
Findings for LLM06 carry the OWASP LLM Top 10 LLM06 identifier along with the corresponding control identifiers in the other frameworks Penaxtra maps, so one result is reflected across each mapped framework.
Frequently asked
What is LLM06 (Excessive Agency)?
Tools and plugins granted to an agent exceed the principle of least privilege. It is an OWASP LLM Top 10 control; Penaxtra assesses it at critical severity.
How does Penaxtra test for LLM06?
The LLM06 identifier is written onto the finding at the moment it is created, not mapped in afterwards, so the JSON and PDF exports come out already in your assessor's structure. Every finding carries the probe that was sent, a SHA-256 digest of the response it provoked, the tier that decided the verdict and its status history from first observation to close. Identity survives a re-scan: a control you closed and that comes back reopens under the same row with a reopen count, rather than arriving as a new issue.
Does a finding for LLM06 help with an audit?
Each finding is tagged with the OWASP LLM Top 10 LLM06 identifier and exported in the PDF and JSON evidence pack, so it appears on the auditor control list with the identifier already attached.