{"schema":"postcutoff/event@1","as_of":"2026-10-12T22:30:00+02:00","url":"https://postcutoff.com/e/2026-10-09-tofu-repeat-after-me-agent-frameworks-mcp-fuzzing/","md":"https://postcutoff.com/e/2026-10-09-tofu-repeat-after-me-agent-frameworks-mcp-fuzzing/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"Adam Bicz","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-10-09-tofu-repeat-after-me-agent-frameworks-mcp-fuzzing","date":"2026-10-09","date_precision":"day","short_title":"ToFu paper: a 'Repeat-After-Me' prompt makes six agent frameworks run tool calls the model refused, and fuzzing finds bugs in 118 of 273 MCP servers","deck":null,"takeaway":"A preprint posted Oct 9, 2026 (arXiv 2610.13651) studies the boundary between a language model, the orchestration framework and its tools.","category":"research","category_label":"Research","importance":2,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":[{"n":1,"title":"arXiv 2610.13651: ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary","url":"https://arxiv.org/abs/2610.13651","type":"paper","group":"primary","domain":"arxiv.org"},{"n":2,"title":"CSO Online: Researchers bypass 6 AI agent frameworks with a simple 'Repeat-After-Me' prompt","url":"https://www.csoonline.com/article/4233811/researchers-bypass-6-ai-agent-frameworks-with-a-simple-repeat-after-me-prompt.html","type":"press","group":"press","domain":"csoonline.com"}],"official":1,"filed":"2026-10-12","updated":"2026-10-12","orgs":["Pennsylvania State University","Université de Montpellier","Dartmouth College"],"title":"ToFu paper: a 'Repeat-After-Me' prompt makes six agent frameworks run tool calls the model refused, and fuzzing finds bugs in 118 of 273 MCP servers","summary":"A preprint posted Oct 9, 2026 (arXiv 2610.13651) studies the boundary between a language model, the orchestration framework and its tools. Its fuzzing framework ToFu found verified security bugs in 343 tools across 118 of 273 MCP servers (3,405 tools tested). CSO Online reports that the paper's \"Repeat-After-Me\" technique got six agent frameworks to execute a tool call that the model had been asked only to repeat. The authors conclude that arguments generated by a model must not be treated as trusted.","key_facts":["Paper: 'ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary', arXiv 2610.13651, Oct 9, 2026; authors Md Nazmul Islam Ananto, Pierre Prevost-Avenel, Colin Smith, Kyungtae Kim, Taegyu Kim, Arslan Khan; not peer-reviewed","ToFu derives security checks for each tool from its metadata and a CWE-guided sanitizer corpus, then generates fuzzing harnesses automatically (abstract)","Result (abstract): 273 MCP servers with 3,405 tools tested; verified bugs in 343 tools across 118 servers","CSO Online (Oct 12): 253 confirmed bugs after manual review, including 64 path-traversal, 7 server-side request forgery, 5 data-exfiltration and 3 OS command-injection flaws; most others were reflected-output or log-injection issues","'Repeat-After-Me' (CSO Online): the attacker asks the model to repeat text formatted as a tool call, then reframes the request as hypothetical; the model emits a structured tool call and the framework executes it, before the model's refusal arrives","Frameworks reported affected: LangGraph, Microsoft Agent Framework, AutoGen, Google Agent Development Kit 2.0, AWS Strands Agents and CrewAI","The detailed demonstration used LangGraph 1.2.0 with Llama 3.1 8B through Ollama, dummy tools and only a system prompt as safeguard; CSO Online notes that this does not show every deployment behaves the same way","The missing pre-execution check was reported to LangGraph's maintainers; LangChain, Microsoft, Google, AWS and CrewAI had not responded to CSO Online"],"key_numbers":[],"tags":["security","agents","mcp","tool-use","prompt-injection","fuzzing","langgraph","autogen","crewai","vulnerabilities"],"science":null,"body_md":"## What happened\n\nThe paper looks at what happens after a model produces output in an agent system: the orchestration layer turns that output into\na tool call, and the tool runs it. The authors show two weaknesses. First, frameworks execute any well-formed tool call in the\nmodel's output, so a prompt that gets the model to reproduce a call as \"quoted text\" can trigger a real action even when the\nmodel declines the request. Second, many tools do not enforce the limits their own descriptions state and rely on the model to\nsend safe inputs; automated fuzzing found path traversal, request forgery and command injection in open-source MCP servers.\n\nThe framework-bypass details come from CSO Online's report; the abstract covers the fuzzing results only.\n\n## Why it matters\n\nAgent safety is often discussed as a property of the model. This work locates failures in the software around the model:\nrefusals do not help if the framework acts on the text anyway, and tool servers need their own input validation and\nauthorization checks.","disputed":[],"related":[{"id":"2024-11-25-model-context-protocol","url":"https://postcutoff.com/e/2024-11-25-model-context-protocol/","date":"2024-11-25","date_precision":"day","short_title":"Anthropic open-sources the Model Context Protocol (MCP)","deck":null,"takeaway":"Solved the N×M integration problem for agents and became core infrastructure of the agentic AI ecosystem.","category":"agents","category_label":"Agents","importance":5,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":3,"official":3,"filed":"2026-09-29","updated":"2026-09-29","orgs":["Anthropic"]}],"people":[],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-10-12","type":"filed","text":"Created (evening)"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-10-12","run":null,"sources_read":null,"updated":"2026-10-12","human_review":null,"version":null},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":162,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":101,"in_training_data":false},{"model_id":"gemini-3-8-flash","name":"Gemini 3.8 Flash","cutoff":"2026-03","days_after":192,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":131,"in_training_data":false}],"short_url":null}