Preprint reveals security issues in model context protocol systems
A preprint titled ToFu published online on October 9, 2026, highlights security flaws in systems that manage interactions between artificial intelligence models and the tools they use. The research, conducted by six experts, explores how models translate instructions into actual actions performed by external tools.Attack method exploits model instructions
The researchers describe a "Repeat-After-Me" attack where an attacker tricks a model into copying a command it has seen before. The challenge lies in transitioning this copied instruction into an actual tool call. In their demonstration, a simple chain of commands in a text response is not enough to trigger execution.Setup details the attack demonstration
Appendix B of the preprint outlines the setup used for the attack demonstration. It includes LangGraph 1.2.0, a specific model called Llama 3.1 8B, and two fictional tools with no real effect. The only protection is a system instruction that asks the model to refuse dangerous requests. The attack succeeds when the model is tricked into producing a structured call to a harmful tool.Attack conditions remain favorable for attackers
The researchers point out that the conditions used in the demonstration are favorable for attackers. The model used is relatively simple, the tools and formats are known in advance, and the only defense is a system instruction. The paper does not test the success rate on more advanced models.Security implications and proposed solutions
The second part of the research focuses on how to secure these systems. The authors argue that if an attacker can control the arguments passed to a tool, each argument should be treated as potentially harmful. They propose using metadata already available to the model to create security checks and testing for vulnerabilities using 74 different detection methods.Findings reveal numerous security flaws
The researchers tested 273 Python or JavaScript servers, identifying 253 reproducible bugs across 118 of them. These flaws include issues like improper input escaping, unauthorized file access, and injection attacks. These vulnerabilities can occur without causing the program to crash, making them harder to detect.Existing protections require configuration
The paper notes that some existing protections are available, such as optional parameters in the ToolNode of LangGraph that can intercept and block calls. CrewAI also offers a pre-call hook to block dangerous actions. However, these features must be actively configured and used to be effective.Limitations of the current research
The first version of ToFu focuses on testing individual tool calls rather than complex sequences of actions or interactions between multiple agents. It also does not cover defects that do not produce noticeable effects during runtime, leaving some security risks unexplored.
