# AI API and Function-Calling Attacks

> Master the security risks of LLM function calling and API integrations. Learn to exploit and defend against unauthorized actions, SSRF, and parameter manipulation in agentic workflows.

Canonical: https://codelivly.com/learning-paths/ai-api-and-function-calling-attacks
Last updated: 2026-10-12

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Rooms | 5 |
| Lessons | 14 |
| Estimated time | 2 h 30 min |

This intermediate learning path explores the critical vulnerabilities introduced when Large Language Models are granted the ability to interact with external systems via APIs and function calling. You will learn how attackers manipulate tool arguments to trigger Server-Side Request Forgery (SSRF), OS Command Injection, and unauthorized data access, and how to implement robust defenses like strict parameter validation, allowlisting, and least-privilege execution.

## Rooms in this path

1. [What is Function/Tool Calling in LLM Apps](https://codelivly.com/rooms/what-is-functiontool-calling-in-llm-apps) - Understand the mechanics of LLM function calling and how granting AI access to external APIs transforms it from a…
2. [Abusing Function Calling for Unauthorized Actions](https://codelivly.com/rooms/abusing-function-calling-for-unauthorized-actions) - Master how attackers manipulate LLM tool arguments to perform unauthorized actions, escalate privileges, and bypass…
3. [Parameter Injection into Tool Calls](https://codelivly.com/rooms/parameter-injection-into-tool-calls) - Master how attackers inject malicious payloads into LLM-generated tool arguments, bypassing validation and triggering…
4. [AI API Rate Limiting, Auth and Abuse Testing](https://codelivly.com/rooms/ai-api-rate-limiting-auth-abuse-testing) - Master the infrastructure security of LLM APIs. Learn to exploit and defend against token exhaustion, API key leakage,…
5. [Guided Lab: Hijacking a Tool Call to Access Unauthorized Data](https://codelivly.com/rooms/guided-lab-hijacking-a-tool-call-to-access-unauthorized-data) - A hands-on guided lab demonstrating how to exploit Broken Object Level Authorization (BOLA) by manipulating an LLM into…

## Related

- [Career path: AI Red Teaming and Adversarial ML](https://codelivly.com/career-paths/ai-red-teaming-and-adversarial-ml)
- [Bug Bounty Workflow & Disclosure](https://codelivly.com/learning-paths/bug-bounty-workflow-and-disclosure)
- [Security Monitoring and Compliance Automation](https://codelivly.com/learning-paths/security-monitoring-and-compliance-automation)
- [Software Supply Chain Security](https://codelivly.com/learning-paths/software-supply-chain-security)