ToFu fuzzer finds security bugs in 118 of 273 MCP servers
Why it matters
Penn State, Université Montpellier and Dartmouth researchers' ToFu (arXiv, Oct 9) uses each MCP tool's own description to pick security checks from 74 semantics-aware sanitizers, then fuzzes it with schema-valid inputs and checks what the tool actually does. Across 273 open-source MCP servers (3,405 tools), 508 candidates became 253 bugs in 343 tools across 118 servers after the authors' manual verification: 115 reflected output, 64 path traversal, 58 log injection, plus SSRF, data exfiltration and command injection. Tools often don't enforce the limits their descriptions promise, and a 'Repeat-After-Me' trick turns verbatim repetition into a dispatched tool call on LangGraph, MAF, ADK 2.0, AutoGen, Strands and CrewAI. Preprint; treat model-written tool arguments as untrusted.
Read the source: arXiv (Penn State / Dartmouth) (opens in a new tab)
All hits from 19 Oct 2026More SecurityGet the daily hits by email