Unauthorized Function Invocation

Unauthorized Function Invocation occurs when an attacker manipulates an AI system into calling a legitimate function, tool, or API that the current user is not authorized to access, enabling privileged actions through a trusted integration.

Function-enabled AI applications can perform real actions across enterprise systems, including reading files, changing records, sending communications, initiating transactions, and invoking administrative workflows. Unauthorized Function Invocation occurs when the model is persuaded to select one of these capabilities despite the user lacking the required authorization.

The vulnerability becomes especially dangerous when the application treats the model’s decision as proof that an operation is permitted. OWASP identifies excessive functionality, permissions, and autonomy as root causes of damaging agent actions and recommends enforcing authorization in downstream systems rather than allowing the language model to make access-control decisions.

AI platforms often provide the model with a catalog of functions it may call. Tool-selection controls can restrict the set of available functions, but those controls do not replace user-specific authorization, resource-level permission checks, or approval workflows. Current function-calling platforms support constrained tool lists and strict parameter schemas, but the application must still determine whether the user is permitted to execute the selected action.

An attacker may exploit weak authorization boundaries by:

• Prompting the model to invoke an administrative function
• Supplying another user’s resource identifier
• Reframing a privileged action as a routine request
• Chaining lower-risk functions into a restricted outcome
• Exploiting generic service accounts used by AI integrations
• Inducing the agent to skip approval or confirmation steps

The function itself may be legitimate and correctly implemented. The security failure occurs because the request is executed without independently confirming the user’s identity, role, scope, ownership, and permitted action.

1. The attacker interacts with a function-enabled AI application.
2. The attacker crafts instructions targeting a privileged function or resource.
3. The model selects the legitimate function and generates valid arguments.
4. The application forwards the call without enforcing user-specific authorization.
5. The downstream system executes the unauthorized operation.
6. The attacker receives sensitive data, modifies records, or triggers a privileged workflow.

• Function-enabled AI assistants
• Enterprise AI agents
• AI copilots
• Customer service automation
• CRM and ERP integrations
• Email and collaboration tools
• Financial and payment systems
• Cloud administration platforms
• File and document repositories
• Internal enterprise APIs
• Remote MCP-enabled tools

Confidentiality: Critical
Unauthorized functions may expose customer records, internal documents, credentials, financial data, or regulated information.

Integrity: Critical
Attackers may alter enterprise records, approvals, configurations, transactions, or workflow state.

Availability: High
Privileged functions may delete data, disable services, revoke access, or interrupt automated operations.

Operational Risk: Critical
A trusted AI interface may become an indirect administrative channel into connected enterprise systems.

Compliance Risk: High
Unauthorized processing or disclosure may create violations involving privacy, financial, healthcare, contractual, or industry-specific requirements.

Overall Business Impact: Critical

Redbot Security evaluates Unauthorized Function Invocation through controlled authorization and business-logic testing of AI-connected functions.

Testing includes:

• Invoking functions outside the test user’s assigned role
• Replacing authorized resource identifiers with unauthorized identifiers
• Testing horizontal and vertical privilege boundaries
• Attempting administrative actions through conversational prompts
• Evaluating generic service-account permissions
• Testing approval and confirmation bypasses
• Chaining permitted functions toward restricted outcomes
• Verifying downstream authorization enforcement
• Comparing model-visible functions across user roles
• Reviewing whether read-only users can trigger write or delete operations

Testing should confirm that authorization is enforced for every call, every resource, and every user context, regardless of what the AI model requests.

Monitor for:

• Function calls inconsistent with the authenticated user’s role
• Access to resources owned by other users or departments
• Administrative actions initiated by low-privilege accounts
• Sudden use of rarely invoked privileged functions
• AI actions executed through generic high-privilege identities
• Repeated authorization failures followed by successful calls
• High-impact actions without approval events
• Function sequences that bypass expected workflow steps
• Tool calls that do not match the user’s original request
• Data access outside established business context

Correlate the initiating prompt, authenticated identity, model-selected function, function arguments, approval events, downstream authorization decision, and final system response.

MITRE ATLAS includes techniques for AI agent tool invocation, prompt injection, valid-account abuse, exfiltration through agent tools, and destructive actions through agent tools, making these the closest current mappings

LLM01:2025 – Prompt Injection LLM06:2025 – Excessive Agency LLM02:2025 – Sensitive Information Disclosure, when unauthorized functions expose protected data LLM05:2025 – Improper Output Handling, when model-generated calls are executed without sufficient validation. Prompt injection can alter model behavior and enable unauthorized access, while Excessive Agency directly addresses damaging actions caused by excessive functionality, permissions, or autonomy in tool-enabled AI systems