org 25 | OWASP Top 10 for LLM v1. 0 The following options will not prevent Excessive Agency, but can limit the level of damage caused Log and monitor the activity of LLM plugins/tools and downstream systems to identify where undesirable actions are taking place, and respond accordingly Implement rate-limiting to reduce the number of undesirable actions that can take place within a given time period, increasing the opportunity to discover undesirable actions through monitoring before significant damage can occur.  Example Attack Scenario An LLM-based personal assistant app is granted access to an individual's mailbox via a plugin in order to summarise the content of incoming emails.  To achieve this functionality, the email plugin requires the ability to read messages, however the plugin that the system developer has chosen to use also contains functions for sending messages.  The LLM is vulnerable to an indirect prompt injection attack, whereby a maliciously-crafted incoming email tricks the LLM into commanding the email plugin to call the 'send message' function to send spam from the user's mailbox