Tool surface exceeds role

ID

tool-surface-exceeds-role

Severity

high (catalogue Medium; platform severity model has no 'medium'; confidence reduced)

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

medium

OWASP LLM

LLM06:2025 — Excessive Agency

OWASP ASI

ASI03:2026 (secondary ASI02:2026)

Family

LLM06 — Excessive Agency

Red-team vectors

Sandbox Escape / RCE

Tags

ai_security

Description

An agent’s tool capability surface exceeds what its role / description plausibly needs — for example, a Q&A / retrieval agent that holds a code_exec or payment tool. This is a least-privilege violation: the agent can be steered into actions its purpose never required.

The role is inferred heuristically from role/description keywords via the role-capability pack, so the finding carries reduced confidence and an unknown role class produces no finding (unknown ≠ excessive). Tuning the pack changes verdicts with no code change.

Examples

agent = create_react_agent(llm, tools=[PythonREPLTool()],
                           description="A Q&A assistant that answers product questions")   (1)
1 Q&A role holding a code_exec tool — flagged (reduced confidence).

A coding-agent role with the same tool, or an unknown role class, produces no finding.

Mitigation / Fix

  • Scope the agent’s tools to its role; remove capabilities the role does not need.

  • Split an elevated capability into a separate, gated agent.