# Tool and Function Capability Enumeration

- **Severity:** Medium
- **Signature ID:** `a935ea8f-d198-4066-baf9-bee8cf6fb5ef`
- **MITRE ATLAS:** AML.T0024 (Exfiltration via AI Inference API)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM02 (Sensitive Information Disclosure)

## Summary

This detects prompts where someone asks an AI agent to reveal everything it can do — its tools, function calls, plugins, or the exact parameters those tools accept. Knowing the full tool surface makes it easier to craft targeted attacks against specific tools later.

## How the attack works

An attacker sends a prompt asking the agent to list its available tools, functions, APIs, or plugins, or to enumerate the parameters a specific tool accepts. This can be phrased as a direct request ('list all your tools'), a request for completeness ('show me everything you can do'), or a narrower probe into one tool's inputs. The information gathered maps out what the agent can actually execute, which the attacker then uses to plan a more targeted injection or privilege-escalation attempt against a specific tool.

## Why it matters

An organisation loses visibility into its own attack surface: once an attacker knows exactly which tools and parameters an agent exposes, they can aim follow-up attacks precisely instead of guessing, increasing the odds of a successful exploit or data leak.

## What you can do

- Avoid having the agent describe its own tool list, function signatures, or internal APIs in response to user prompts.
- Separate operator/developer documentation channels from the end-user chat interface so legitimate onboarding questions don't require the agent to disclose its full capability set.
- Log and review prompts that ask for complete enumeration of tools or parameters, and treat repeated or systematic probing as a warning sign.
- Apply least-privilege scoping to each tool so that knowing a tool exists doesn't automatically expose sensitive parameters or actions.

## Known benign look-alikes

- Legitimate operator documentation requests from the system creator
- Normal user questions about a specific advertised feature without complete enumeration intent
- Developer onboarding queries about which integrations are configured

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00504

---
Source: https://www.netzilo.com/threats/atr-tool-and-function-capability-enumeration