Researchers Got Six Agent Frameworks to Run an Attacker's Tool Call
1Six Agent Frameworks Ran a Tool Call the Model Was Asked to Repeat
Six agent frameworks ran a tool call that an attacker had asked an AI model to repeat word for word, according to a paper posted on October 9, 2026. An AI agent calls its tools, such as an MCP tool, through a framework like these, which treats a reply shaped like a tool call as a request to run it. Six researchers from Pennsylvania State University, Université Montpellier and Dartmouth College call the attack Repeat-After-Me. The attacker writes the tool call with arguments of their choosing, while the model only has to echo it. The attack targets the point where an agent's access turns into an action on another system.
A seemingly benign text-repetition request thus gives the attacker direct control over the tool invocation and its arguments.
Ananto et al., ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary, October 2026
The attacker needs a way to put text in front of the model, by typing it or through injected content, and names a tool the agent already offers. The paper's appendix shows the attack on LangGraph, LangChain's framework, driving Llama 3.1 8B, a small open model, whose system prompt told it to decline dangerous requests. Asked for a dummy tool named launch_missiles that did nothing, the model refused but printed the call as plain text, which LangGraph did not run. Asked again, with the call framed as hypothetical and a request to output nothing but the quoted text, the model returned it as a structured call. LangGraph ran the tool at once, while the refusal arrived only after the tool had returned.
The paper calls the framework the orchestrator and concludes that "the system prompt shaped what the model said, not what the orchestrator did." The researchers reported the missing check to the LangGraph maintainers. The paper prints a transcript for LangGraph alone and names the other five as Microsoft Agent Framework, AutoGen, Google's Agent Development Kit (ADK) 2.0, AWS's Strands and CrewAI.
2Verified Bugs Turned Up in 118 of 273 Open-Source MCP Servers
The larger part of the paper tests the tools themselves. The researchers built ToFu, an automated tester that reads each tool's own description, works out the input rules it implies and sends crafted arguments to check them. A tool whose description confines a file argument to a workspace, for example, should refuse a path outside it. Across 273 open-source MCP servers that ran cleanly in their test, they confirmed by hand 253 bugs in 118 servers. Most were outputs that echoed the crafted input back unescaped, paths that pointed outside the permitted folder and log entries the input could forge. During testing, one server deleted files outside its workspace on the machine running the tests.
A September paper on MCP authorization found that hiding a tool from an agent did not stop a script from calling it when the server checked nothing at invocation. ToFu's authors reach the same verdict for tool inputs.
These findings suggest that tool metadata should serve as an enforceable security contract, with tool implementations independently validating the security properties associated with their inputs rather than delegating that responsibility to the LLM or orchestration layer.
Ananto et al., ToFu, October 2026
Source: Md Nazmul Islam Ananto, Pierre Prevost-Avenel, Colin Smith, Kyungtae Kim, Taegyu Kim and Arslan Khan, ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary, arXiv:2610.13651, October 9, 2026.