LLM03 Excessive Agency

The scenario

Q-Bank's assistant has a powerful backend tool that can perform every financial operation, with insufficient permission checks. An attacker uses a believable story and crafted instructions to make it perform an unauthorized transaction while skipping identity verification and audit controls.

How it works

Excessive Functionality & Permissions: The broad `execute_financial_operation` tool handles inquiries, transfers, and loans instead of separating those functions into narrowly scoped tools. Misusing one tool can therefore cause substantial harm.

Improper Permission Control: The prompt explicitly sets `bypass_auth` and `bypass_audit`. Because the backend fails to reject these dangerous parameters, the AI can perform actions beyond its authorized scope.

Social Engineering & Deception: The attacker claims customer support supplied a correction script for a missing reward payment. The assistant trusts this fabricated request and performs the malicious action.

Q-Bank

Digital Banking

Welcome

Lily Wang

Total balance

$88,520

******* ****1234

Recent transactions

Q-Bot Assistant