Defending against exploitation of built-in API capabilities