Researchers from Pennsylvania State University, Université de Montpellier and Dartmouth College tricked six widely used artificial intelligence agent frameworks into running tool calls written by an attacker, simply by asking the underlying model to repeat the call text. The technique, which they call “Repeat-After-Me,” worked on LangChain’s LangGraph, Microsoft Agent Framework, Microsoft’s AutoGen, Google’s Agent Development Kit 2.0, AWS’s Strands Agents and CrewAI, according to a October 12, 2026, CSO Online report summarizing the academic paper.
“A seemingly benign text-repetition request thus gives the attacker direct control over the tool invocation and its arguments,” the researchers wrote in the paper, as quoted by CSO Online. The same paper reports that a testing tool the team built — named ToFu — found verified security bugs in 118 of the 273 open-source Model Context Protocol (MCP) servers it was able to run. After manual review, they confirmed 253 bugs affecting 343 tools.
In the documented demonstration, the trick works in two stages. First, the researchers asked a model to repeat text formatted as a tool-invocation request. The model initially refused the dangerous request but included the requested text in its response; the framework did not execute it at that stage. They then framed the request as hypothetical and instructed the model to reproduce only the supplied text. The model emitted a structured tool invocation, which LangGraph dispatched. The simulated tool returned a result before the model issued another refusal.
“The refusal text and the executed call disagree: the system prompt shaped what the model said, not what the orchestrator did,” the researchers wrote. The paper details a full demonstration on LangGraph 1.2.0 running Meta’s Llama 3.1 8B model through Ollama. The agent had two dummy tools, make_bomb and launch_missiles, which returned fixed data and had no real effect. Its only safeguard was a system prompt telling the model to decline dangerous requests. When first asked to repeat a launch_missiles call, the model refused but printed the call as text, and LangGraph ran nothing; on the second formulation, it executed the call with the attacker’s arguments, and the model’s refusal arrived only after the tool had returned.
For the other five frameworks, the paper says the researchers reproduced the behavior but provides no further detail and no full transcript, according to CSO Online. The findings do not show that every deployment of the six frameworks behaves this way. LangChain, Microsoft, Google, AWS and CrewAI did not immediately respond to the outlet’s requests for comment. The researchers said they had reported the missing pre-execution check to the LangGraph maintainers.
Vibhum Dubey, an independent security researcher and red teamer cited by CSO Online, framed the finding as an architectural weakness rather than a single bug. “A model can generate a technically valid tool call that is still inappropriate for the task,” he said. “If the orchestration layer treats that output as sufficient authority to execute the operation, a model-level manipulation becomes a system-level security issue.” How exploitable the technique is depends on what an attacker can influence and what the agent is allowed to do: a read-only agent poses a different risk from one that can reach confidential files, change code repositories or run commands.
Because an attacker can dictate the arguments that reach a tool, the researchers argued that tools must validate their own inputs. ToFu reads each tool’s description and checks whether the tool enforces the limits it advertises, such as staying inside a designated folder. Of the 253 confirmed bugs, the most serious were 64 path-traversal flaws, seven server-side request forgery (SSRF) flaws, five data-exfiltration bugs and three OS command-injection flaws. Most of the rest were reflected-output and log-injection issues, which the paper rates as lower impact in many deployments.
The researchers wrote that “many tools implicitly rely on the LLM to sanitize inputs,” even though prompts, retrieved content and output from other tools can all influence those inputs. That observation connects to a broader 2026 pattern: as the Model Context Protocol and similar frameworks popularize wiring models to external tools, the attack surface shifts from the prompt toward the trust chain among orchestrator, model and tool. A model’s verbal refusal is not an access-control decision.
Dubey said security teams should separate a model’s ability to request an action from the system’s authority to carry it out. Every sensitive tool call should undergo independent authorization checks; valid syntax or a convincing explanation from the model should never substitute for permission. He also recommended running agents with restricted file and network access, isolated execution environments and limited credentials, with explicit approval for sensitive or irreversible operations, and monitoring sequences of tool calls rather than judging each action in isolation.
The paper has not been peer-reviewed, CSO Online notes. The servers were tested at fixed code versions, and the paper does not say whether any of the flaws have since been fixed or exploited in the wild. That caveat matters: 253 verified bugs in a corpus of 273 open-source MCP servers is a signal of insufficient maturity in the tool ecosystem, not necessarily a map of active production exposures. Still, the share — 118 affected servers — suggests the problem is systemic rather than anecdotal.
For enterprise security teams, the practical message is twofold. First, harden orchestration: do not execute a tool call merely because the model emitted it in structured form; require allow/deny policies, argument validation and, where appropriate, human confirmation. Second, audit MCP tools and equivalents with fuzzing guided by the semantics of their descriptions — ToFu’s approach — because trusting the model “not to ask” for path traversal or SSRF is a false premise if an attacker can make the model repeat a malicious call.
The episode fits growing concern about autonomous agents acting on real systems. While labs such as Anthropic report evaluation-time bypasses with live internet access, this research shows a different vector: the model need not “want” to attack; it is enough for the orchestrator to treat its output as permission. In that sense, Repeat-After-Me is less a classic banned-content jailbreak and more a privilege-separation failure between layers.
In conclusion, the Penn State, Montpellier and Dartmouth work, as summarized by CSO Online on October 12, 2026, leaves a concrete warning for anyone building or deploying agents: six popular frameworks executed attacker-dictated tool calls after a repetition request, and more than four in ten open-source MCP servers evaluated carried verified bugs in their tools. Until independent authorization is the norm — not the system prompt — the phrase “repeat after me” may still outweigh a model’s refusal.
