Automation without programming now comes in two kinds. Rule-based tools run fixed steps that a person lays out by hand, while AI agents take a request in plain language and decide on their own which tools to call. The second kind removes the coding barrier but adds a new risk: the OWASP Top 10 for LLM Applications 2025 names "Excessive Agency," and the U.S. National Institute of Standards and Technology (NIST) reported attack success rates of up to 81% in its agent hijacking tests.
Key takeaways
- A rule-based automation does only what its author specified; an AI agent chooses actions at run time from a goal.
- OWASP lists three root causes of excessive agency: too many functions, too many permissions, and too little human approval.
- NIST describes agent hijacking as hidden instructions in data an agent reads, such as an email, file, or website.
- In NIST's tests, the strongest new attack succeeded 81% of the time against a baseline attack's 11%.
- Narrow permissions and approval for high-impact steps limit the damage when a model errs.
Fixed rules versus a goal
A traditional no-code automation is a set of triggers and actions: when a form is submitted, copy the row into a spreadsheet and send a confirmation. Every branch exists because a person drew it, so its behavior can be read in advance and tested. The cost is that anything unforeseen stops the flow or is handled wrongly.
An AI agent starts from a goal such as "sort the incoming invoices and flag the odd ones." NIST's Center for AI Standards and Innovation describes agentic systems as systems powered by large AI models that can automate complex tasks on a user's behalf. The user writes no steps. The model reads the request, picks tools, and acts. That flexibility is the appeal, and it is also why the safeguards differ: the actions cannot be fully listed beforehand.
What OWASP calls excessive agency
The OWASP Gen AI Security Project publishes a Top 10 for LLM Applications, and its 2025 edition includes LLM06:2025 Excessive Agency. It defines the problem as a weakness that lets a model-based system take damaging actions in response to unexpected, ambiguous, or manipulated model output, whether the cause is a hallucination or a prompt injection. The damage depends on what the application is connected to.
OWASP names three root causes. Excessive functionality means the agent holds tools it does not need. Excessive permissions means a tool has more access to other systems than the task requires. Excessive autonomy means high-impact actions are carried out without independent verification or approval. Its examples include a read-only document tool that also has delete functions, a database tool that connects with rights to insert, update, and delete when it only needs to read, and a deletion feature that runs without asking the user to confirm.
Hijacking through the data an agent reads
NIST's technical blog on agent hijacking evaluations, released January 17, 2025 and updated December 19, 2025, defines hijacking as a type of indirect prompt injection. An attacker hides instructions in material an agent may read, so the agent performs a different, potentially harmful task. For a no-code user the practical point is that the content an agent processes, including incoming email and web pages, can itself carry instructions.
The blog reports tests on the AgentDojo benchmark. In the Workspace environment the success rate rose from 11% for the strongest baseline attack to 81% for the strongest new red-team attack on held-out tasks. Across the five injection tasks the average success rate was 57%, and with 25 attempts per attack it rose to 80%. NIST concluded that hijacking will remain a persistent challenge and that defenses must be evaluated against new attacks. These are benchmark results, not rates for any specific product.
A permissions worksheet for a plain-language automation
The table below turns OWASP's measures into questions for a person setting up an agent. It is an illustrative example, with a hypothetical invoice-sorting task.
| Question | Hypothetical invoice task | OWASP measure |
|---|---|---|
| Which tools does the agent need? | Read the shared inbox, write to one spreadsheet | Minimize extensions and their functionality |
| Can any tool do more than the task? | Use a read-only mailbox connection, not a full account | Minimize extension permissions |
| Whose identity does it act under? | The requesting user's account, not a shared administrator login | Execute extensions in the user's context |
| What needs a person's approval? | Sending a payment, deleting a message | Require user approval for high-impact actions |
| Who enforces limits? | The spreadsheet and mail systems, not the model | Complete mediation in downstream systems |
OWASP adds that logging, monitoring, and rate limiting do not prevent excessive agency but can limit the harm it causes.
Where the line between tool and developer sits
Removing code from the setup does not remove the design work. Someone still decides what the system may touch, what counts as success, and who reviews exceptions. An agent that writes its own scripts also creates code that nobody on the team may read. For organizations in Canada and the United States, handling personal information or financial records raises privacy and record-keeping duties that apply regardless of whether a person or an agent carried out the step, so the operator remains accountable for the result.
FAQ
Is a no-code automation tool the same as an AI agent?
No. A no-code automation follows steps a person defined. An agent chooses its own actions from a goal, which makes its behavior harder to predict in advance.
What is prompt injection?
It is an attack in which instructions are placed in content that a model processes. NIST calls agent hijacking a type of indirect prompt injection, where the hidden instructions sit in data such as an email, file, or website.
Do the NIST percentages apply to every AI agent?
No. They come from tests on a particular benchmark, AgentDojo, with attacks designed by NIST's team. They show that defenses can fail under adaptive attacks, not how often any product is compromised.
What is the simplest safeguard?
OWASP's measures point to giving the agent the fewest tools and the narrowest permissions the task needs, and requiring a person's approval before actions that are hard to undo.
Related reading
- Whether AI can run without any code
- How artificial intelligence differs from automation
- Automation, augmentation, and employment
- The role of AI and automation in industry
More in AI Tools and Industry.
Last verified: October 2026
Sources
- LLM06:2025 Excessive Agency, OWASP Top 10 for LLM Applications 2025, OWASP Gen AI Security Project
- Technical Blog: Strengthening AI Agent Hijacking Evaluations, NIST Center for AI Standards and Innovation, January 17, 2025 (updated December 19, 2025)