Function Enumeration Abuse

Function Enumeration Abuse occurs when an attacker discovers, maps, or infers the functions and tools available to an AI system, then uses that knowledge to identify privileged capabilities, sensitive integrations, and potential paths for follow-on attacks.

AI applications commonly expose function names, descriptions, parameters, and schemas to help models select and invoke tools. Attackers may use direct questioning, malformed requests, error responses, prompt injection, or repeated probing to enumerate these capabilities.

Once the available functions are understood, an adversary can identify high-value operations such as account management, data retrieval, file access, payment processing, administrative actions, or external API calls. Function enumeration is often a reconnaissance step that enables more targeted parameter injection, unauthorized invocation, privilege abuse, or data-exfiltration attempts. Function descriptions and JSON schemas directly influence how models select and construct tool calls, making unnecessary exposure of this metadata a meaningful security concern.

Function-enabled AI systems are typically provided with a catalog of available tools. Each entry may include a function name, purpose, accepted parameters, and expected data types.

An attacker may attempt to reveal that catalog by:

• Asking the model to list its available tools
• Requesting internal function names or schemas
• Triggering validation and parsing errors
• Submitting incomplete or malformed arguments
• Manipulating the model into discussing hidden capabilities
• Comparing responses across repeated prompts
• Observing tool-call behavior and downstream effects

Enumeration does not necessarily result in immediate compromise. Its value lies in reducing uncertainty and allowing the attacker to design precise follow-on attacks against known capabilities.

1. The attacker interacts with a function-enabled AI application.
2. The attacker submits prompts or malformed requests intended to expose tool details.
3. The model, application, or error handler reveals function names, parameters, descriptions, or behavioral clues.
4. The attacker maps available capabilities and identifies high-risk functions.
5. The attacker develops targeted payloads for parameter injection, unauthorized invocation, privilege escalation, or data access.
6. Follow-on attacks are executed against the discovered functions.

• AI applications using function calling
• Enterprise AI assistants
• Autonomous and semi-autonomous agents
• AI copilots
• Tool-enabled chatbots
• API-connected language models
• Customer service automation platforms
• CRM and ERP integrations
• Financial and payment workflows
• Administrative automation systems

Confidentiality: Medium
Function metadata may reveal internal APIs, privileged capabilities, data sources, and integration architecture.

Integrity: Medium
Enumeration can enable targeted manipulation of functions and business workflows.

Availability: Low
The technique is primarily reconnaissance-focused, although aggressive probing may increase resource use or trigger failures.

Operational Risk: High
Discovered functions can provide attackers with a roadmap for more damaging follow-on attacks.

Compliance Risk: Medium
Exposed integrations may reveal systems that process regulated, personal, financial, or confidential information.

Overall Business Impact: Medium to High

Redbot Security evaluates Function Enumeration Abuse through controlled reconnaissance and adversarial interaction with the AI application.

Testing includes:

• Direct requests for available tools and functions
• System prompt and configuration disclosure attempts
• Malformed parameter submissions
• Schema validation error analysis
• Function-name guessing
• Behavioral comparison across prompts
• Tool-selection boundary testing
• Hidden-function discovery attempts
• Authorization checks against discovered capabilities
• Follow-on testing using identified function metadata

Testing should confirm whether users can discover functions they are not authorized to invoke and whether error responses disclose unnecessary implementation details.

Monitor for:

• Repeated requests to list tools, plugins, actions, or functions
• Prompts requesting parameter schemas or internal API details
• High volumes of malformed function arguments
• Repeated function-name guessing
• Validation failures across multiple tools
• Requests unrelated to the application’s intended purpose
• Sudden probing of administrative or high-risk capabilities
• Attempts to access functions outside the user’s role
• Unusual sequences of failed tool calls followed by successful targeted calls

Correlate AI prompts, validation errors, function-call logs, user identity, and downstream API activity.

MITRE ATLAS Discover AI Agent Configuration Discover AI Artifacts Discover LLM System Information AI Agent Tool Invocation, as a potential follow-on technique LLM Prompt Injection, when prompts are used to expose hidden capabilities

LLM01:2025 – Prompt Injection LLM06:2025 – Excessive Agency LLM07:2025 – System Prompt Leakage LLM05:2025 – Improper Output Handling, when application errors disclose schemas or internal details OWASP identifies prompt injection, excessive agency, system prompt leakage, and unsafe handling of model outputs as risks that can expose or misuse tool-enabled application capabilities.