arXiv:2606.20023: When lower privileges suffice — LLM agents choose overly powerful tools

LLM agents routinely choose overly powerful tools

Researchers Kaiyue Yang and co-authors from Peking University and the Chinese Academy of Sciences published findings on June 18, 2026 showing that systems such as GPT-4o, Claude 3.5 Sonnet, and Llama 3 select tools with excessive privileges even when functional alternative tools with lower access levels are available.

Least-privilege — the principle of minimal authority — is a fundamental security rule: an agent that only needs to read a file should not take a tool that also grants write or delete rights. The paper shows that LLM agents violate this rule systematically, not as an exception.

What is ToolPrivBench and what does it measure?

ToolPrivBench is a new benchmark that quantifies over-privileged tool selection across multiple domains — from file management to API calls. The key distinction: the benchmark tests behavior in two situations — during normal operation and after a transient failure of a lower-privileged tool.

The results are unambiguous: all tested models choose high-authority tools even without necessity, and the problem worsens after transient failures. By comparison, static evaluations without failure scenarios consistently underestimate this risk because they do not examine how agents behave under pressure.

Why doesn’t general safety training help?

General safety training, a standard phase in model building, does not transfer reliably to privilege-level decisions. Models that theoretically understand least-privilege still choose the more powerful tool in practice. Prompt-based controls offer limited protection and are the first to fail during tool failures.

The authors propose privilege-aware post-training defense — a specialized fine-tuning phase that teaches agents to escalate privileges only when necessary. The approach significantly reduces unnecessary high-authority calls while preserving general capabilities, unlike blanket restrictions that impair usefulness.

Implications for the security of production systems

Without privilege-aware mechanisms, LLM agents with access to tools — file systems, databases, cloud APIs — effectively operate with overly broad permissions. Combined with prompt injection attacks, over-privileged tool selection becomes a direct privilege escalation vector. ToolPrivBench positions itself as a standard evaluation checkpoint before the production deployment of agentic systems.