The agent is given tools it doesn’t need. A mail-reading agent that also has a send function. A document agent that also has delete. A code assistant that can also run shell commands. The extra tools sit idle — until an attacker finds them.
The agent’s credentials grant more access than required. An agent that only needs to read customer records is authenticated with an admin service account. An email summarizer is granted a full-access OAuth token instead of a read-only scope. When an attacker hijacks the agent, they inherit those credentials.
The agent acts without asking. It can send emails, delete files, run commands, and approve transactions — all without a human checkpoint. When something goes wrong (a bad prompt, a hallucination, an injection), there is nothing to catch it before the action is taken.
Every tool, permission, and autonomous capability an agent has is attack surface. Design for minimum viable authority, not maximum convenience.