# Agent Capability Enumeration via Structured Parse Request

- **Severity:** High
- **Signature ID:** `52230dda-74ec-4cbe-b12b-d0609f748ae7`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI06 (Goal and Instruction Manipulation), LLM06 (Excessive Agency)

## Summary

Someone asks an AI agent to describe itself in a structured format, like JSON, framed as a 'security researcher' request or a request to 'parse this response.' The agent obliges and hands over a manifest of every tool, function, and capability it has access to.

## How the attack works

The attacker sends a prompt that asks the agent to parse its own self-description, or a prior agent response, into a structured list of tools, functions, and descriptions. Framing the request as coming from a security researcher, or as a neutral parsing task, makes the agent more likely to comply without treating it as suspicious. The agent returns a structured inventory of its available capabilities. The attacker now has a map of the attack surface: which tools exist, what they do, and how they're named, which is needed to craft targeted injection or privilege-escalation attempts against specific tools.

## Why it matters

An organisation loses the secrecy of its agent's internal tool set, giving an attacker a ready-made target list for follow-on attacks such as prompt injection aimed at specific high-value functions or attempts to invoke privileged tools directly.

## What you can do

- Treat requests that ask the agent to 'parse', 'list', or 'output as JSON' its own tools or a prior response as sensitive, and require authentication or authorization checks before responding.
- Avoid having the agent's system prompt or tool descriptions echoed back verbatim in any output the end user can trigger.
- Limit how much detail the agent's self-description exposes about internal tool names, parameters, and permissions by default.
- Monitor for repeated attempts to elicit structured capability listings, especially ones invoking 'researcher' or 'audit' framing without prior authorization.

## Known benign look-alikes

- Legitimate developer documentation requests about tool capabilities
- System integration queries asking which functions are available for normal use
- Security audits performed by the system operator with explicit authorization

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00491

---
Source: https://www.netzilo.com/threats/atr-agent-capability-enumeration-via-structured-parse-request