# Researchers Got Six Agent Frameworks to Run an Attacker's Tool Call

_Researchers say six agent frameworks ran a tool call an attacker asked the model to repeat, in a paper posted October 9, 2026. Across 273 open-source MCP servers, they confirmed 253 bugs in 118 where a tool did not enforce the input rules its own description sets._

By Johannes Keienburg, CEO & Founder  
Published: 2026-10-14  
Source: https://www.cakewalk.security/blog/agent-frameworks-repeat-after-me-tool-calls

---

## Six Agent Frameworks Ran a Tool Call the Model Was Asked to Repeat

Six agent frameworks ran a tool call that an attacker had asked an AI model to repeat word for word, according to a paper posted on October 9, 2026. An AI agent calls its tools, such as an [MCP](/glossary/model-context-protocol) tool, through a framework like these, which treats a reply shaped like a tool call as a request to run it. Six researchers from Pennsylvania State University, Université Montpellier and Dartmouth College call the attack Repeat-After-Me. The attacker writes the tool call with arguments of their choosing, while the model only has to echo it. The attack targets the point where an agent's access turns into an action on another system.

> A seemingly benign text-repetition request thus gives the attacker direct control over the tool invocation and its arguments.

_Ananto et al., ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary, October 2026_

The attacker needs a way to put text in front of the model, by typing it or through injected content, and names a tool the agent already offers. The paper's appendix shows the attack on LangGraph, LangChain's framework, driving Llama 3.1 8B, a small open model, whose system prompt told it to decline dangerous requests. Asked for a dummy tool named launch_missiles that did nothing, the model refused but printed the call as plain text, which LangGraph did not run. Asked again, with the call framed as hypothetical and a request to output nothing but the quoted text, the model returned it as a structured call. LangGraph ran the tool at once, while the refusal arrived only after the tool had returned.

The paper calls the framework the orchestrator and concludes that "the system prompt shaped what the model said, not what the orchestrator did." The researchers reported the missing check to the LangGraph maintainers. The paper prints a transcript for LangGraph alone and names the other five as Microsoft Agent Framework, AutoGen, Google's Agent Development Kit (ADK) 2.0, AWS's Strands and CrewAI.

## Verified Bugs Turned Up in 118 of 273 Open-Source MCP Servers

The larger part of the paper tests the tools themselves. The researchers built ToFu, an automated tester that reads each tool's own description, works out the input rules it implies and sends crafted arguments to check them. A tool whose description confines a file argument to a workspace, for example, should refuse a path outside it. Across 273 open-source [MCP servers](/glossary/mcp-server) that ran cleanly in their test, they confirmed by hand 253 bugs in 118 servers. Most were outputs that echoed the crafted input back unescaped, paths that pointed outside the permitted folder and log entries the input could forge. During testing, one server deleted files outside its workspace on the machine running the tests.

A [September paper on MCP authorization](/blog/mcp-tool-visibility-not-enforcement) found that hiding a tool from an agent did not stop a script from calling it when the server checked nothing at invocation. ToFu's authors reach the same verdict for tool inputs.

> These findings suggest that tool metadata should serve as an enforceable security contract, with tool implementations independently validating the security properties associated with their inputs rather than delegating that responsibility to the LLM or orchestration layer.

_Ananto et al., ToFu, October 2026_

> In the LangGraph test the model refused and the call ran anyway. A tool that a framework runs in its own process, or an MCP server on the user's machine, does not pass through the MCP Gateway. For those, the check this paper asks for belongs inside the tool. What an agent may call should follow from the person it works for, kept to what the task needs. The MCP Gateway evaluates each governed call against user, action and app attributes before it runs. Its policy does not evaluate argument values. Each allowed, denied or escalated call lands in one record.

_Comment from Gil Röder, CPO & Co-Founder_

Source: Md Nazmul Islam Ananto, Pierre Prevost-Avenel, Colin Smith, Kyungtae Kim, Taegyu Kim and Arslan Khan, [ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary](https://arxiv.org/abs/2610.13651), arXiv:2610.13651, October 9, 2026.