Slides 9–13 · 4 attack patterns, each a real incident
Slide 9 · Types Overview
Four ways Excessive Agency gets exploited.
Each is a different failure mode. Each has a documented real-world incident.
1️⃣
Overpowered Tools — Slide 10
Agent given capabilities beyond what the task requires. Extra tools sit idle until an attacker triggers them. Demonstrated in Slack AI data exfiltration (August 2024).
2️⃣
Excessive Permission Scope — Slide 11
Agent’s credentials have broader access than needed. Admin OAuth when read-only suffices. OpenClaw (2026): corporate AI agents with elevated cross-system privileges became undetected shadow admin accounts.
3️⃣
MCP Tool Poisoning — Slide 12
Attacker controls or compromises an MCP server, embeds malicious instructions in tool descriptions. CVE-2025-54136: 60–72% attack success rate in live deployments. Up to 200,000 vulnerable instances.
4️⃣
Indirect Injection → Action — Slide 13
Attacker plants instructions in data the agent reads. Agent follows them using full authority. CVE-2025-53773: code comment → disabled confirmations → malware download → C2 connection.