You’d never give a new hire root access to production on day one. Yet the fastest way to ship an AI feature is to do exactly that to a piece of software that can be talked into things: hand the agent a powerful key, wire it to your database and a few APIs, and let it figure the rest out. It demos brilliantly. It’s also the setup behind a growing share of 2026’s worst incidents.
The principle that protects you is the oldest one in security, and almost every vibe-coded agent ignores it: least privilege. Give the agent the minimum access the task needs — and nothing more.
Why over-permissioned agents are so dangerous
An agent combines two risky things: it takes actions, and it can be manipulated by its input via prompt injection. Multiply those together and the blast radius is whatever access you gave it.
- If the agent holds a database key with full read/write, a single injected instruction can read or wipe everything — the same exposure as an open database with no row-level security.
- If it can call internal APIs freely, it can be steered to call the ones it shouldn’t.
- If it runs with one shared, all-powerful credential, every user effectively borrows that power — a cousin of one tenant reading another’s data.
OWASP’s 2026 work on agentic applications catalogues exactly this class of risk — identity abuse, tool misuse, excessive agency. The common thread: the agent could do far more than the task ever required, so when something goes wrong, it goes very wrong.
How to check
For every tool, key, and API your agent can touch, ask one question: does this specific task actually need this? Usually the honest answer is “no, it just needed read access to one table” or “it only needed to draft a message, not send it.”
- Scope credentials to the narrowest permission that works.
- Put a human (or a hard rule) in front of consequential, irreversible actions — sending money, deleting data, emailing your list.
- Treat the agent as untrusted: assume its input can be hijacked, and make sure the worst it can do is small.
The agent doesn’t need to be your most senior employee with the master key. It needs to be the intern who can only touch the one drawer the job requires.
This is exactly the kind of thing that’s invisible in a working demo and obvious to someone who reads the code asking “what can this agent actually reach?” A senior read maps what your AI features and agents are allowed to do — and tells you, in plain English, where to take the keys away before someone talks your app into using them.