Autorun agent without human-in-the-loop

autorun-agent-without-human-in-the-loop

Severity

high

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

OWASP LLM

LLM06:2025 — Excessive Agency

OWASP ASI

ASI02:2026 (secondary ASI09:2026)

Family

LLM06 — Excessive Agency

Red-team vectors

Sandbox Escape / RCE

Description

A fully-autonomous (agent_autorun) agent holds at least one side-effecting tool — filesystem write, email, payment, or VCS write — with no human-in-the-loop / approval gate. The agent can take irreversible actions with no human check between plan and act. An autorun agent with only read-only tools, or one with an approval step, is not flagged.

Examples

agent = AgentExecutor(agent=a, tools=[StripePaymentTool()], automation_level="agent_autorun")   (1)

1	Autonomous agent with a payment tool and no approval gate — flagged.

Adding a human-in-the-loop / approval step (interrupt_before, require_approval, …) produces no finding.

Mitigation / Fix

Add an approval / human-in-the-loop step before side-effecting tool calls.
Scope the agent to read-only tools when full autonomy is required.