excessive agency

OWASP LLM06 is where AI security stops being novel and becomes a least-privilege problem, which is exactly why interviewers love it. The control list is short; knowing which control to lead with is the test.

MCP turned 'install a plugin' into 'inject text into every conversation.' Interviewers ask this to see if you understand why tool descriptions are an attack surface, and what a least-privilege agent runtime looks like.

The agent has real money authority and a write path into the system of record, which is the exact shape attackers want. The strong answer is layered enforcement outside the model, with the spend cap and the chain rule in code, not in the prompt.