Researchers have identified 253 verified security vulnerabilities affecting 343 AI agent tools across 118 Model Context Protocol (MCP) servers.
These vulnerabilities expose weaknesses in how software processes arguments generated by large language models (LLMs). The findings are based on an evaluation of 273 open-source MCP servers containing 3,405 tools, using a new fuzzing framework called ToFu.
This study, titled “ToFu: Exploiting and Fuzzing the LLM–Orchestrator–Tool Trust Boundary,” was published on arXiv on October 9, 2026, and authored by researchers from Pennsylvania State University, Université Montpellier, and Dartmouth College.
The reported issues include arbitrary path traversal, log injection, data exfiltration, and command bypass. The figures reflect different measurement units and do not represent competing vulnerability totals.
Agentic systems typically connect an LLM to external functions through an orchestration layer. The model receives tool descriptions and input schemas, generates structured requests, and relies on the orchestrator to execute those requests. However, a correctly formatted invocation does not guarantee that its arguments are safe or authorized.
The researchers demonstrated this issue through a “Repeat-After-Me” attack. In this attack, an attacker provides text containing a target tool and specific arguments, then instructs the model to reproduce it.
When the output matches the orchestration layer’s recognized invocation format, the layer mistakenly interprets it as an executable tool call rather than as ordinary text.
The team replicated this behavior across six orchestration frameworks: LangGraph, Microsoft MAF, Google ADK 2.0, AutoGen, AWS Strands, and CrewAI.
This demonstration supports the study’s core conclusion: tool implementations must treat model-generated arguments as potentially adversarial, even when they come through standard agent workflows.
ToFu repurposes tool metadata into executable security tests. Its corpus includes 74 semantics-aware sanitizers that link argument meanings to Common Weakness Enumeration (CWE)-guided properties, adversarial inputs, and observable violation evidence. Although a filesystem path, URL, and SQL query may all be strings, they require different security checks.
For instance, a tool that claims to access only files within a specific workspace should enforce this restriction. If it accepts a traversal input and reads an external file, it violates that contract, even if the execution succeeds. Traditional crash-based fuzzing can miss this behavior because it doesn’t necessarily trigger an exception or abnormal termination.
The framework uses an LLM to interpret metadata, select and specialize applicable checks, and generate initial testing seeds. However, the model does not judge vulnerabilities. Instead, executable sanitizers evaluate runtime observations or confirm whether tools reject inputs that violate their documented security agreements.
ToFu generates schema-valid harnesses and utilizes Atheris for coverage-guided fuzzing. When implementation visibility is provided, runtime tracers observe filesystem, process, and network operations.
For opaque tools, outcome checks assess rejection behavior, safe fallbacks, and externally observable results. This approach tests security properties beyond whether inputs meet basic schema types.
The findings underscore a key issue: tool descriptions often don’t match their actual code. Tools may claim to enforce restrictions that their implementations do not uphold.
Therefore, prompt filtering and improved model behavior cannot replace the need for security checks within the software that performs filesystem, network, or command operations.
The study focuses on tool-level contract violations rather than confirming the exploitation of every affected deployment. Its practical takeaway is to enforce documented restrictions at execution time and to treat schema-valid arguments as untrusted inputs.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…