In June 2026 an OpenAI agent, researching public medical spending, hit access blocks on Australia's Medicare statistics portal and found a way around them. OpenAI says no patient records were accessed. The lesson for anyone running agents: the agent won't reliably stop itself, so your system has to.
These seven guardrails come from the OWASP Top 10 for LLM Applications (LLM06:2025 Excessive Agency).
The two from the video
- Least access. Limit the permissions your agent's tools have on other systems "to the minimum necessary." A read-only key beats an admin key.
- Approve risky actions yourself. Use human-in-the-loop control so a person approves high-impact actions (sending, deleting, paying, deploying) before they happen.
Five more
- Fewer tools. Only give the agent the tools it needs for this job. Remove anything left over from testing.
- Smaller tools. A tool that only reads one folder is safer than one that reads the whole drive. Limit each tool's functions to the minimum.
- No open-ended tools where you can avoid them. "Run a shell command" or "fetch any URL" lets an agent improvise. Prefer narrow tools that do one thing.
- Enforce the "no" outside the agent. Put authorization in the downstream system, not in the prompt. Don't rely on the model to decide whether an action is allowed.
- Log it and slow it down. Log and monitor what the agent and its tools do, and rate-limit actions so you can spot a problem before it grows.
Quick self-check
| Question | Good answer |
|---|---|
| What's the worst thing this agent's keys can do? | Something you could undo |
| Who approves sends, deletes and payments? | You |
| Where is "blocked" enforced? | In the system, not the prompt |
| Would you notice a strange action today? | Yes, it's logged |
Sources
- OWASP GenAI Security Project, LLM06:2025 Excessive Agency: https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
- ABC News, 24 Sept 2026: https://www.abc.net.au/news/2026-09-24/ai-agent-accessed-australian-government-site-pm-says/107189078