Tool and Function Capability Enumeration

How the attack works

An attacker sends a prompt asking the agent to list its available tools, functions, APIs, or plugins, or to enumerate the parameters a specific tool accepts. This can be phrased as a direct request ('list all your tools'), a request for completeness ('show me everything you can do'), or a narrower probe into one tool's inputs. The information gathered maps out what the agent can actually execute, which the attacker then uses to plan a more targeted injection or privilege-escalation attempt against a specific tool.

Netzilo detection

Why it matters

An organisation loses visibility into its own attack surface: once an attacker knows exactly which tools and parameters an agent exposes, they can aim follow-up attacks precisely instead of guessing, increasing the odds of a successful exploit or data leak.

What you can do

• →Avoid having the agent describe its own tool list, function signatures, or internal APIs in response to user prompts.
• →Separate operator/developer documentation channels from the end-user chat interface so legitimate onboarding questions don't require the agent to disclose its full capability set.
• →Log and review prompts that ask for complete enumeration of tools or parameters, and treat repeated or systematic probing as a warning sign.
• →Apply least-privilege scoping to each tool so that knowing a tool exists doesn't automatically expose sensitive parameters or actions.

Known benign look-alikes

• Legitimate operator documentation requests from the system creator
• Normal user questions about a specific advertised feature without complete enumeration intent
• Developer onboarding queries about which integrations are configured

References

• https://agentthreatrule.org/en/rules/ATR-2026-00504

Related threats