AI Agent权力过大：如何审计过度代理风险

Author: Mohit Kumar Project: Bulwark – An open-source security stack for AI agents GitHub: mk12002/Bulwark

This article is part of the Bulwark series, where I explore practical approaches to securing AI systems, agentic workflows, and the AI software supply chain.*

给一个 AI Agent 配备读取文件的工具和发送邮件的工具，你得到的不是生产力助手——而是一个数据泄露管道，任何提示词注入都可以触发它。两个工具本身都不是恶意的，但组合起来就是。这是 OWASP LLM06: Excessive Agency（过度代理）所描述的风险类别，已跻身十大 LLM 风险之一——然而实际上几乎没有任何开源工具来测量它。所以我自己做了一个。

Excessive Agency = an agent holds more capability, permissions, or autonomy than its task needs. It's OWASP LLM06 and a headline in the OWASP Top 10 for Agents (2026).

Excessive Agency = an agent holds more capability, permissions, or autonomy than its task needs. It's OWASP LLM06 and a headline in the OWASP Top 10 for Agents (2026).

危险的情况是有毒的组合：一个敏感数据源（读取文件/密钥/数据库）能够触及一个出口汇点（网络/邮件）——这是一条由各自无害的工具构建而成的泄露路径。

危险的情况是有毒的组合：一个敏感数据源（读取文件/密钥/数据库）能够触及一个出口汇点（网络/邮件）——这是一条由各自无害的工具构建而成的泄露路径。

Warden 将任何 Agent 配置规范化为一种中间表示（IR），构建能力图，找到 source→sink 路径，对组合的代理度打分 0–100，以及——核心功能——将 Agent 重写为最小权限原则。

Warden 将任何 Agent 配置规范化为一种中间表示（IR），构建能力图，找到 source→sink 路径，对组合的代理度打分 0–100，以及——核心功能——将 Agent 重写为最小权限原则。

一个命名的风险，近乎为零的开源工具。这就是空白地带：最接近的先例是一篇学术论文，而不是一个可交付使用的工具。

一个命名的风险，近乎为零的开源工具。这就是空白地带：最接近的先例是一篇学术论文，而不是一个可交付使用的工具。

模型扫描器（如我的另一个工具 Airlock）问的是"这部分是恶意的吗？"但你完全可以把一个危险系统全部用良性部件组装起来。危险来自组合——连接方式、作用域、缺失的防护栏、自主性级别。

OWASP 给它命名是因为它是将所有其他 AI 漏洞转化为实际行动的那类风险。聊天机器人中的提示词注入只是尴尬；但同一个注入在配备了 shell 工具且无人为门槛的 Agent 中就是一次入侵。根本原因很无聊也很普遍：工具太多、作用域过广、密钥生命周期过长、缺少审批门槛、自主性无界。

然而——尽管针对模型的成熟扫描器已经存在，针对 MCP 服务器的扫描器也在涌现，但本质上还没有一个广泛采用的开源工具，能够摄入 Agent 配置并告诉你它权限过高。最好的先例是一篇学术论文。这个差距正是 Warden 存在的原因。

The core concept: capabilities, not tool names

推理 Agent 能力的关键技巧是：不再考虑工具名称，而是开始考虑能力。read_notes、fetch_url、run_bash、send_slack 是名字；在它们之下是 FS_READ、NET_OUT、SHELL、SECRET_READ 这样的能力。一旦每个工具都被标注了它的能力，过度授权就变成了一个图可达性问题。

类比：这是混乱代理问题（confused-deputy problem），披上了 LLM 的外衣。每个工具都是一个拥有合法权力的代理；Agent 是一个可以被诱导串联它们的代理。如果敏感数据源能够触及离开你掌控范围的出口，你就拥有了一条等待触发的泄露通道。

How it actually works

One IR to rule every framework

Agent 配置方式有十几种——MCP client JSON、LangChain Python、CrewAI 的 agents.yaml、OpenAI Assistants 配置。Warden 将所有这些规范化为单一的 AgentSpec IR，这样分析引擎永远不需要关心你用的是哪个框架。导入器静态解析——LangChain 导入器用正则表达式读取你的 .py 文件；它从不执行你的 Agent。

The ten things it looks for (A-codes)

加上一目了然的代理度评分（0–100）放在头部——这是对能力广度、无门槛高影响工具、泄露路径和缺失限制的加权求和。不是黑盒，你可以阅读这个公式。

The money feature: it rewrites the agent

发现问题只是及格线。Warden 的 --recommend 给你一个加固版本：

$ warden audit devops-agent.yaml --recommend

  HIGH    A3   run_shell has no human-in-the-loop gate            run_shell
  HIGH    A8   run_shell executes code/shell without a sandbox    run_shell
  MEDIUM  A1   run_shell declares a wildcard scope                run_shell
  MEDIUM  A10  autonomous agent has no runaway guards             devops-agent

┌──────────────── Least-privilege recommendation ────────────────┐
│ Applied:                                                        │
│   - tool 'run_shell': add confirm gate (high-impact action)     │
│   - tool 'run_shell': require sandbox for code/shell execution  │
│   - tool 'run_shell': replace wildcard scope with an allow-list │
│   - agent: add runaway guards (max_iterations=25, timeout_s=300)│
└─────────────────────────────────────────────────────────────────┘

以及策略配置文件（--profile strict|balanced|permissive）设定审计的严格程度，而不伪造严重级别——permissive 模式只为低噪音 CI 门禁显示阻塞性问题；strict 模式为全面审计显示一切。

The attack surface — three scenarios

Scenario 1: the injection-to-exfil chain (A2 + A5). Attacker goal: steal data. Technique: a poisoned web page or document tells the agent, mid-task, to read a secret and POST it to attacker.com. Why it works: the agent has both SECRET_READ and NET_OUT, and nothing gates the egress. Detection: Warden's capability graph flags the source→sink path before deployment — you don't need the attack to happen to know the path exists.

Scenario 2: the unsandboxed shell (A8 + A3). Attacker goal: RCE on your infra. Technique: talk the agent into running a shell command. Why it works: the agent has a run_shell tool with no sandbox and no human confirmation. Detection: Warden flags A8 (unsandboxed exec) and A3 (no gate) on the same tool — a two-finding combo that screams "remove or gate this."

Scenario 3: the runaway loop (A10). Attacker goal: burn your budget or cause chaos. Technique: get the agent stuck in a self-reinforcing loop. Why it works: no max_iterations, no timeout, no budget cap. Detection: Warden flags any autonomous agent missing runaway guards.

Defenses that actually work

Audit before you ship, and apply the rewrite. warden audit agent.yaml --recommend — then actually take the minimized spec. Every tool the agent doesn't provably need is attack surface.

Break the source→sink pairs. If a role needs both a sensitive source and an egress sink, split it into two agents, or put an allow-list / mediation boundary between them.

Gate high-impact actions. Shell, financial, destructive, and external-comms tools get a human confirmation. Non-negotiable.

Bound autonomy. max_iterations, timeout_s, and a budget cap on every autonomous loop. A kill switch is not optional.

Scan the parts too (--scan-parts runs Airlock on the MCP servers the agent wires in). A least-privilege agent built from poisoned tools is still compromised.

---

Hot take: "give the agent all the tools and let the model decide" is the chmod 777 of the AI era. It feels productive right up until a prompt injection turns your helpful assistant into a confused deputy with your credentials. Least privilege isn't a nice-to-have for agents; it's the only thing standing between a bad prompt and a breach.

---

Reason in capabilities, not tool names — over-privilege is a graph-reachability problem.

Reason in capabilities, not tool names — over-privilege is a graph-reachability problem.

Hunt toxic combinations (sensitive source → egress sink); they're built from benign parts.

Hunt toxic combinations (sensitive source → egress sink); they're built from benign parts.

Normalize to one IR so the analysis is framework-agnostic and never executes agent code.

Normalize to one IR so the analysis is framework-agnostic and never executes agent code.

Score it, then minimize it — a 0–100 agency score plus an automatic least-privilege rewrite turns audit into action.

Score it, then minimize it — a 0–100 agency score plus an automatic least-privilege rewrite turns audit into action.

Gate high-impact tools and bound autonomy — the two controls that stop injection-to-action.

Gate high-impact tools and bound autonomy — the two controls that stop injection-to-action.

OWASP LLM06:2025 — Excessive Agency — the risk, defined by OWASP.

OWASP LLM06:2025 — Excessive Agency — the risk, defined by OWASP.

OWASP Top 10 for Agentic Applications (2026) — where agent-specific risks are codified.

OWASP Top 10 for Agentic Applications (2026) — where agent-specific risks are codified.

Auditing MCP Servers for Over-Privileged Tool Capabilities (arXiv) — the closest academic prior art to Warden.

Auditing MCP Servers for Over-Privileged Tool Capabilities (arXiv) — the closest academic prior art to Warden.

Intent-Governed Tool Authorization for AI Agents (arXiv) — a runtime complement to static least-privilege analysis.

Intent-Governed Tool Authorization for AI Agents (arXiv) — a runtime complement to static least-privilege analysis.

Confused deputy problem — the 1988 idea that explains toxic tool combinations perfectly.

Confused deputy problem — the 1988 idea that explains toxic tool combinations perfectly.