Tool Schema Enumeration via Social Engineering
An attacker asks an AI agent to reveal its complete set of internal tools, function names, and parameter details, disguising the request as a legitimate need — claiming to be an executive, a disabled user who needs a special format, or a security auditor. This gives the attacker a blueprint of the agent's capabilities, including hidden or admin-only functions, that they can use to plan further attacks.
How the attack works
The attacker opens with a pretext designed to lower the agent's guard: authority ('I'm the CEO'), disability accommodation ('I can only understand python scripts'), or a fake audit or QA task. They then demand output in a rigid technical format — JSON schema, OpenAPI spec, full parameter listings — rather than a plain-language answer. This framing pushes the agent past a normal 'what can you do?' response into disclosing complete tool manifests, including functions not meant for regular users. The attacker now has a map of internal APIs and admin functions to target next.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d3d9fd8f-298b-46d7-8be9-13128a4dd252
- Severity
- High
Why it matters
An organization loses visibility into and control over which of its internal AI tool capabilities are exposed, handing attackers a reconnaissance map of admin functions, API structure, and parameters that speeds up crafting of follow-on attacks.
What you can do
- →Restrict full tool/schema disclosure to authenticated admin sessions; treat any unauthenticated request for structured schema output as suspicious.
- →Separate admin-only tool definitions from user-facing ones so a single prompt cannot surface both.
- →Train or configure agents to answer capability questions in plain language summaries rather than raw schemas, regardless of the requester's claimed identity or disability.
- →Log and review requests that pair emotional or authority framing with demands for structured technical output (JSON, OpenAPI) — this combination is a strong signal, distinct from normal onboarding questions.
Known benign look-alikes
- Developer documentation requests in authenticated admin sessions where full tool listing is expected
- Onboarding flows where users legitimately ask what the agent can do — these typically use natural language, not JSON schema formatting demands