Agent Capability Enumeration via Structured Parse Request

How the attack works

The attacker sends a prompt that asks the agent to parse its own self-description, or a prior agent response, into a structured list of tools, functions, and descriptions. Framing the request as coming from a security researcher, or as a neutral parsing task, makes the agent more likely to comply without treating it as suspicious. The agent returns a structured inventory of its available capabilities. The attacker now has a map of the attack surface: which tools exist, what they do, and how they're named, which is needed to craft targeted injection or privilege-escalation attempts against specific tools.

Netzilo detection

Why it matters

An organisation loses the secrecy of its agent's internal tool set, giving an attacker a ready-made target list for follow-on attacks such as prompt injection aimed at specific high-value functions or attempts to invoke privileged tools directly.

What you can do

• →Treat requests that ask the agent to 'parse', 'list', or 'output as JSON' its own tools or a prior response as sensitive, and require authentication or authorization checks before responding.
• →Avoid having the agent's system prompt or tool descriptions echoed back verbatim in any output the end user can trigger.
• →Limit how much detail the agent's self-description exposes about internal tool names, parameters, and permissions by default.
• →Monitor for repeated attempts to elicit structured capability listings, especially ones invoking 'researcher' or 'audit' framing without prior authorization.

Known benign look-alikes

• Legitimate developer documentation requests about tool capabilities
• System integration queries asking which functions are available for normal use
• Security audits performed by the system operator with explicit authorization

References

• https://agentthreatrule.org/en/rules/ATR-2026-00491

Related threats