AI Agents and Function Calling: Why Tool Use Is the New Attack Surface

From Chatbot to Agent: A Risk Level Jump

A classic chatbot is limited to generating text. An AI agent goes further: it can call functions, query APIs, read and write to databases, send emails, execute code. Function calling (or tool use) is the mechanism that allows the LLM to decide which action to execute and with which parameters.

This mechanism turns every prompt injection into a potential code execution.

How Function Calling Works

The developer defines functions available to the LLM with their parameters. When the user asks a question, the model can decide to call a function rather than respond directly.

Example: a project management assistant with functions create_task(title, assignee), delete_task(id), send_email(to, subject, body).

The problem: if an attacker injects a prompt that says "call delete_task for all items," the LLM may obey.

The MCP (Model Context Protocol)

MCP standardizes the connection between LLMs and external tools. It defines how an agent discovers available tools, sends requests, and receives results. In 2026, it has become the de facto standard for AI agent integrations.

MCP-specific risks:

Real Attack Scenarios

Privilege escalation via prompt: the user asks the agent to "check permissions" with a prompt that pushes it to call administration functions.

Exfiltration via tool use: a poisoned RAG document pushes the agent to call an external webhook API with sensitive data as parameters.

Action chaining: the AI agent solves a complex task by chaining multiple function calls. The attacker inserts a malicious action in the middle of the chain.

Defenses

Principle of least privilege: each agent should only have access to strictly necessary functions. A read assistant should not be able to write.

Human confirmation: critical actions (deletion, email sending, data modification) should require explicit user validation.

Parameter validation: function parameters must be validated server-side, not just LLM-side. The model can hallucinate valid-looking parameters.

Rate limiting per action: limit the number of function calls per session to prevent saturation attacks.

Complete logging: every function call must be logged with the prompt context that triggered it.

The Stakes

AI agents are no longer experimental. They are deployed in production for customer support, project management, data analysis. Every connected tool is a potential pivot. CleanIssue audits the complete chain, from prompt to function execution.