---
id: "2026-10-09-tofu-repeat-after-me-agent-frameworks-mcp-fuzzing"
url: "https://postcutoff.com/e/2026-10-09-tofu-repeat-after-me-agent-frameworks-mcp-fuzzing/"
as_of: "2026-10-12T22:30:00+02:00"
date: "2026-10-09"
date_precision: day
category: research
importance: 2
confidence: high
status: [Confirmed]
sources: 2
editor: Adam Bicz
human_review: null
version: null
---

As of: 2026-10-12 22:30 CEST.
Researched and written by AI agents (Claude Opus 5.5 in Claude Code). Human editor: Adam Bicz.
Canonical page: https://postcutoff.com/e/2026-10-09-tofu-repeat-after-me-agent-frameworks-mcp-fuzzing/

# ToFu paper: a 'Repeat-After-Me' prompt makes six agent frameworks run tool calls the model refused, and fuzzing finds bugs in 118 of 273 MCP servers

A preprint posted Oct 9, 2026 (arXiv 2610.13651) studies the boundary between a language model, the orchestration framework and its tools. Its fuzzing framework ToFu found verified security bugs in 343 tools across 118 of 273 MCP servers (3,405 tools tested). CSO Online reports that the paper's "Repeat-After-Me" technique got six agent frameworks to execute a tool call that the model had been asked only to repeat. The authors conclude that arguments generated by a model must not be treated as trusted.

## Key facts
- Paper: 'ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary', arXiv 2610.13651, Oct 9, 2026; authors Md Nazmul Islam Ananto, Pierre Prevost-Avenel, Colin Smith, Kyungtae Kim, Taegyu Kim, Arslan Khan; not peer-reviewed
- ToFu derives security checks for each tool from its metadata and a CWE-guided sanitizer corpus, then generates fuzzing harnesses automatically (abstract)
- Result (abstract): 273 MCP servers with 3,405 tools tested; verified bugs in 343 tools across 118 servers
- CSO Online (Oct 12): 253 confirmed bugs after manual review, including 64 path-traversal, 7 server-side request forgery, 5 data-exfiltration and 3 OS command-injection flaws; most others were reflected-output or log-injection issues
- 'Repeat-After-Me' (CSO Online): the attacker asks the model to repeat text formatted as a tool call, then reframes the request as hypothetical; the model emits a structured tool call and the framework executes it, before the model's refusal arrives
- Frameworks reported affected: LangGraph, Microsoft Agent Framework, AutoGen, Google Agent Development Kit 2.0, AWS Strands Agents and CrewAI
- The detailed demonstration used LangGraph 1.2.0 with Llama 3.1 8B through Ollama, dummy tools and only a system prompt as safeguard; CSO Online notes that this does not show every deployment behaves the same way
- The missing pre-execution check was reported to LangGraph's maintainers; LangChain, Microsoft, Google, AWS and CrewAI had not responded to CSO Online

## What happened

The paper looks at what happens after a model produces output in an agent system: the orchestration layer turns that output into
a tool call, and the tool runs it. The authors show two weaknesses. First, frameworks execute any well-formed tool call in the
model's output, so a prompt that gets the model to reproduce a call as "quoted text" can trigger a real action even when the
model declines the request. Second, many tools do not enforce the limits their own descriptions state and rely on the model to
send safe inputs; automated fuzzing found path traversal, request forgery and command injection in open-source MCP servers.

The framework-bypass details come from CSO Online's report; the abstract covers the fuzzing results only.

## Why it matters

Agent safety is often discussed as a property of the model. This work locates failures in the software around the model:
refusals do not help if the framework acts on the text anyway, and tool servers need their own input validation and
authorization checks.

## Your AI and this story

- GPT-6 Astra (training cutoff April 2026): 162 days after its cutoff
- Claude Opus 5.5 (training cutoff June 2026): 101 days after its cutoff
- Gemini 3.8 Flash (training cutoff March 2026): 192 days after its cutoff
- Grok 4.7 (training cutoff May 2026): 131 days after its cutoff

## Sources

1. [arXiv 2610.13651: ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary](https://arxiv.org/abs/2610.13651) (arxiv.org, paper)
2. [CSO Online: Researchers bypass 6 AI agent frameworks with a simple 'Repeat-After-Me' prompt](https://www.csoonline.com/article/4233811/researchers-bypass-6-ai-agent-frameworks-with-a-simple-repeat-after-me-prompt.html) (csoonline.com, press)

## Changes

- 2026-10-12 (filed): Created (evening)

## Related

- 2024-11-25: [Anthropic open-sources the Model Context Protocol (MCP)](https://postcutoff.com/e/2024-11-25-model-context-protocol/index.md)