Measuring How LLM Tool Descriptions, Cross-Tool Ambiguity, and Action Chains Compose into Excessive Agency Exploits

<title>Abstract</title> <p>Large language model (LLM) tool-calling enables powerful agentic workflows but introduces excessive agency: models autonomously invoke destructive tools without confirmation when provided with manipulated context. We present AGENTSPILL, a systematic empirical audit of six exploitation classes targeting LLM tool-selection boundaries, measured across three Gemini tiers at three seeds per variant and three variants per class (162 real trials). We achieve a 50.6 percent overall success rate. The two strongest vectors—tool description injection and tool chaining without confirmation—each reach 78 percent success, demonstrating that language models reliably privilege injected glossary entries over canonical tool descriptions and autonomously batch-execute multi-step destructive sequences when framed as standard operating procedure. The pro-tier model is more permissive than flash tiers in structured exploitation (72 percent overall). We identify an asymmetry: models strongly ground to injected natural-language instructions but weakly substitute real tools for phantom requests (22 percent). All 162 transcripts, six exploitation frameworks, and the fail-closed verification checker are released as open-source artifacts.</p>