What happened
Penn State / Montpellier / Dartmouth researchers (arXiv 2610.13651, posted 2026-10-09; widely covered Oct 12-14) showed that six major orchestration frameworks will dispatch a tool call the model merely echoed under a text-repetition prompt, even when the model separately refuses — the refusal and the executed call disagree. Their ToFu fuzzer confirmed 253 reproducible security bugs across 118 of 273 open-source MCP servers. There is no CVE; it is a working attack class with a demonstration transcript.
Why it matters
This is a cross-framework agent-execution attack class: no network exploit and no standard CVE are needed, only a crafted prompt-plus-orchestrator shortcut. It strips the safety value of model-side refusal for the most widely deployed agent frameworks and, paired with the 253 MCP tool flaws, shows that tool arguments are attacker-controlled end to end. For a defender it is the prioritization signal to move authorization out of the model and into the tool/orchestration boundary.
Attack vector
A 'Repeat-After-Me' prompt frames a dangerous tool invocation as hypothetical text the model should echo; the model issues a refusal in prose yet emits the attacker's exact structured tool call, which the orchestration layer dispatches with no pre-execution authorization check. The ToFu fuzzer independently demonstrated that MCP tools accept schema-valid but adversarial arguments violating their documented constraints (path traversal, SSRF to metadata, command injection).
Affected systems
LangGraph (demonstrated on 1.2.0), Microsoft Agent Framework, AutoGen, Google ADK 2.0, AWS Strands Agents, CrewAI; 118 open-source MCP servers via ToFu
Mitigation
Treat model output as a request, not authorization: add independent per-tool authorization/permission checks before dispatch, validate tool arguments as untrusted inside the tool itself, restrict file/network/credential scope, and enforce approval gates on sensitive/irreversible tool calls. For MCP operators, review the 118 flagged servers for the path-traversal/SSRF/command-injection bugs. No vendor patch — architectural hardening required.