# Tool Schema Enumeration via Social Engineering

- **Severity:** High
- **Signature ID:** `d3d9fd8f-298b-46d7-8be9-13128a4dd252`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0069 (Discover LLM System Information)
- **OWASP:** ASI03 (Identity and Impersonation), ASI09 (Traceability and Accountability Gaps), LLM01 (Prompt Injection), LLM09 (Misinformation)

## Summary

An attacker asks an AI agent to reveal its complete set of internal tools, function names, and parameter details, disguising the request as a legitimate need — claiming to be an executive, a disabled user who needs a special format, or a security auditor. This gives the attacker a blueprint of the agent's capabilities, including hidden or admin-only functions, that they can use to plan further attacks.

## How the attack works

The attacker opens with a pretext designed to lower the agent's guard: authority ('I'm the CEO'), disability accommodation ('I can only understand python scripts'), or a fake audit or QA task. They then demand output in a rigid technical format — JSON schema, OpenAPI spec, full parameter listings — rather than a plain-language answer. This framing pushes the agent past a normal 'what can you do?' response into disclosing complete tool manifests, including functions not meant for regular users. The attacker now has a map of internal APIs and admin functions to target next.

## Why it matters

An organization loses visibility into and control over which of its internal AI tool capabilities are exposed, handing attackers a reconnaissance map of admin functions, API structure, and parameters that speeds up crafting of follow-on attacks.

## What you can do

- Restrict full tool/schema disclosure to authenticated admin sessions; treat any unauthenticated request for structured schema output as suspicious.
- Separate admin-only tool definitions from user-facing ones so a single prompt cannot surface both.
- Train or configure agents to answer capability questions in plain language summaries rather than raw schemas, regardless of the requester's claimed identity or disability.
- Log and review requests that pair emotional or authority framing with demands for structured technical output (JSON, OpenAPI) — this combination is a strong signal, distinct from normal onboarding questions.

## Known benign look-alikes

- Developer documentation requests in authenticated admin sessions where full tool listing is expected
- Onboarding flows where users legitimately ask what the agent can do — these typically use natural language, not JSON schema formatting demands

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01303

---
Source: https://www.netzilo.com/threats/atr-tool-schema-enumeration-via-social-engineering