Fake function definitions can trick a model into treating user-supplied text like an approved tool schema. That creates a path to expose system prompts, hidden instructions, and other sensitive context, which helps attackers understand guardrails and bypass controls. In agentic systems, that exposure is especially dangerous because tool use is the bridge between the model and real actions.
Why This Matters for Security Teams
Fake function definition abuse matters because it exploits the trust boundary between untrusted text and executable tool interfaces. In an agentic system, that boundary is often where policy is supposed to hold: the model interprets a proposed function, decides whether it looks valid, and may then reveal context or prepare a tool call. If attackers can make user content resemble an approved schema, they gain leverage over the model’s tool-selection logic and its hidden instructions.
That creates more than a prompt-injection problem. It can expose system prompts, internal tool catalogs, API semantics, and other control data that helps an attacker refine follow-on abuse. The risk is amplified when tool output is fed back into the model without strict validation, because the model may treat attacker-crafted structure as authoritative. Current guidance in the OWASP Agentic AI Top 10 treats this class of failure as a core agent safety issue, not a minor input-filtering flaw.
In practice, many security teams only notice this after a model has already disclosed sensitive context through a tool-calling path that was never meant to accept user-defined functions.
How It Works in Practice
The abuse pattern usually starts with a payload that imitates a function signature, parameter list, or tool manifest. Rather than seeing it as plain text, the model may infer that the content is a legitimate instruction to define or invoke a capability. If the surrounding orchestration is weak, that imitation can cause the agent to accept attacker-controlled structure as if it were part of the system’s approved toolset.
Once that happens, several failure modes become possible:
- The model reveals system or developer instructions while trying to “explain” the function.
- The agent forwards sensitive context into a tool call or downstream wrapper.
- Hidden tool descriptions or authorization hints become visible to the attacker.
- Subsequent prompts become easier to steer because the attacker has learned the control surface.
Defences need to be architectural, not just lexical. Security teams should keep tool definitions outside the model’s conversational context, validate schemas before they reach the agent, and treat all user-supplied function-like content as untrusted data. It also helps to separate planning from execution: the model can propose an action, but an external policy layer should decide whether a tool exists, whether the caller is authorised, and whether parameters match the expected schema. NIST’s NIST AI Risk Management Framework is useful here because it frames this as a governance and control problem, not just a content moderation problem.
These controls tend to break down when agent frameworks auto-register tools from conversational content or when retrieval layers mix untrusted documents with live tool metadata.
Common Variations and Edge Cases
Tighter tool validation often increases integration overhead, requiring organisations to balance developer convenience against attack resistance. That tradeoff is especially visible in fast-moving agentic environments where teams want flexible plug-ins, but that flexibility can blur the line between instructions, metadata, and executable action.
There is no universal standard for every agent stack yet, but current guidance suggests treating any text that resembles a function definition as suspicious unless it originates from a trusted control plane. This is particularly important in multi-agent workflows, where one agent may pass structured content to another and accidentally preserve attacker-controlled framing. The same caution applies to RAG pipelines that surface documents containing pseudo-schema blocks, because the model may weight formatting as meaning even when the source is untrusted.
For threat modelling, the attack is closely related to prompt injection and tool hijacking, so the MITRE ATLAS adversarial AI threat matrix and the CSA MAESTRO agentic AI threat modeling framework help teams map the control failure to concrete adversary techniques. Where agents can act autonomously against live systems, this also intersects with incident response planning and auditability, which the NIST Cybersecurity Framework 2.0 handles well at the programme level.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, MITRE ATLAS and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Function-definition abuse is a tool hijacking and prompt injection risk in agentic apps. |
| NIST AI RMF | GOVERN | This is a governance and accountability failure around agent tool use and disclosure. |
| MITRE ATLAS | AML.TA0001 | Adversarial manipulation of model inputs maps to ATLAS input abuse techniques. |
| CSA MAESTRO | MAESTRO addresses agent planning, execution, and trust boundaries in autonomous systems. | |
| NIST CSF 2.0 | PR.AA | This abuse exposes weak access assurance and control validation around agent actions. |
Assign ownership for tool approval, schema validation, and escalation paths across the AI lifecycle.
Related resources from NHI Mgmt Group
- Why do agentic AI systems increase initial access and privilege abuse risk?
- Why does persistent memory increase risk in agentic AI systems?
- Why do long-horizon agentic workflows increase the risk of unintended behaviour in AI systems?
- Why do agentic AI systems increase the risk of hidden blast radius and lateral impact?
