Interrogators: Attack Surface Mapping in an Agentic World

Interrogators: Attack Surface Mapping in an Agentic World, published by SANS Institute in October 2025, introduces Agent Interrogator, an open-source framework for mapping the hidden attack surface of AI agents from outside the system, with no access to source code. The research tests a two-stage, LLM-assisted interrogation process against three versions of the Damn Vulnerable LLM Agent (DVLA): a baseline LangChain agent, a version extended with Gmail tools delivered through an MCP server, and a version with no tools at all as a control for false positives.

Key findings:

• Agent Interrogator achieved 100% tool detection against both the baseline DVLA agent and the MCP-extended version across best-case interrogation runs
• Zero hallucinated tools were reported across all 20 interrogation runs on the no-tools control target
• Across 20 repeated runs, the two baseline DVLA functions were each detected in 19 of 20 runs (95%)
• On the MCP-extended agent, the first nine discovered functions (including core banking tools and most Gmail actions) were detected in 100% of the 20 runs
• Detection frequency for later-discovered MCP tools tapered sharply, with gmail_remove_label_from_email at 75%, gmail_remove_label_from_conversation at 55%, and gmail_reply_to_email at only 45%
• The researcher attributes this tapering to the framework's max_iterations setting (capped at 5 for testing) being too low to exhaustively enumerate a large MCP tool set
• A single interrogation run against the baseline DVLA agent missed both functions entirely, a result attributed to a transient error rather than a framework flaw
• The framework occasionally logged duplicate or malformed entries for the same tool (for example, a garbled "checkGetUserTransactions" entry appearing in 3 of 20 runs) because it does not update previously recorded tool data as more detail is uncovered later in the interrogation
• Agent Interrogator does not recursively interrogate tools that are themselves other AI agents, leaving multi-agent ecosystems only partially mapped by the current framework
• The tool is built on a two-stage design: first identifying an agent's high-level capabilities, then enumerating the specific invokable tools behind each capability

The findings suggest that opaque-box interrogation is a viable way to reconstruct an AI agent's attack surface with no visibility into its source code, including tools introduced indirectly through MCP servers with no prompt-level documentation. At the same time, the tapering detection rates on larger tool sets point to a practical trade-off: low iteration limits reduce inference cost but risk incomplete attack surface discovery, meaning security teams need to tune iteration limits and run multiple interrogation passes when assessing agents with many available tools. Testing was conducted against three configurations of the open-source DVLA project (a LangChain-based vulnerable banking agent), one extended with Gmail tools through a Zapier MCP server, using OpenAI's GPT-4.1 to power the interrogator and 20 repeated interrogation runs per target to account for the non-deterministic behavior of LLMs.