{
  "$schema": "https://themachinepress.com/schemas/story-v1.schema.json",
  "schema_version": "1.0.0",
  "document_type": "machine_press_story",
  "story": {
    "story_id": "mp-2026-10-13-001",
    "source_story_id": "tmp-lead-tofu-tool-semantic-fuzzing",
    "edition_id": "mp-2026-10-13-morning-0095",
    "edition_url": "https://themachinepress.com/edition/2026-10-13",
    "position": 1,
    "story_type": "lead",
    "section": "safety-security",
    "editorial_classification": "editorial",
    "headline": "A Fuzzer Finds Weaknesses in 343 AI Tools",
    "slug": "a-fuzzer-finds-weaknesses-in-343-ai-tools",
    "dek": "ToFu probes the handoff from a language model to external software. Its authors report verified bugs across 118 MCP servers.",
    "summary": "ToFu probes the handoff from a language model to external software. Its authors report verified bugs across 118 MCP servers.",
    "body_text": "An agent's tool description can promise restrictions that the underlying software never enforces. ToFu, a new research framework, examines that gap between language-model output, orchestration and tool execution. It derives security checks from tool metadata and a corpus of known weakness patterns, then constructs fuzzing harnesses to test actual behavior. Across 273 MCP servers containing 3,405 tools, the authors report verified bugs in 343 tools spread across 118 servers. These are findings from the evaluated implementations, rather than a measured failure rate for every MCP deployment. The practical implication is clear: an orchestrator cannot safely grant model-generated arguments the status of trusted input. A natural-language description needs enforcement at the software boundary, where the requested operation actually happens. The paper supplies a systematic way to examine that boundary; production remediation still depends on the affected implementation.",
    "why_it_matters": "ToFu probes the handoff from a language model to external software. Its authors report verified bugs across 118 MCP servers.",
    "limitations": [
      "The practical implication is clear: an orchestrator cannot safely grant model-generated arguments the status of trusted input."
    ],
    "importance": 9,
    "canonical_url": "https://themachinepress.com/story/mp-2026-10-13-001/a-fuzzer-finds-weaknesses-in-343-ai-tools",
    "json_url": "https://themachinepress.com/story/mp-2026-10-13-001.json",
    "first_published_at": "2026-10-13T09:00:00.000-04:00",
    "modified_at": "2026-10-13T09:43:56.853-04:00",
    "content_status": "updated",
    "is_carryover": false,
    "carryover_reason": null,
    "key_claims": [
      {
        "claim_id": "claim-mp-2026-10-13-001-001",
        "text": "ToFu probes the handoff from a language model to external software. Its authors report verified bugs across 118 MCP servers.",
        "source_ids": [
          "source-2026-10-13-001"
        ],
        "qualification": "The practical implication is clear: an orchestrator cannot safely grant model-generated arguments the status of trusted input."
      }
    ],
    "source_ids": [
      "source-2026-10-13-001"
    ],
    "tags": [
      "MCP",
      "agent tools",
      "input validation",
      "ToFu"
    ],
    "image_url": "https://themachinepress.com/issues/2026-10-13/lead-tool-semantic-boundary.png",
    "corrections": [
      {
        "correction_id": "correction-2026-10-13-001",
        "revision": 2,
        "summary": "Publication note: The October 13, 2026 edition was prepared and published late on October 13 after the scheduled newsroom task could not start. It retains its October 13 edition date and 9:00 AM America/Detroit reveal time. Reports use evidence available before that cutoff; actual preparation and image-generation times are preserved in the provenance records.",
        "published_at": "2026-10-13T09:43:56.853-04:00",
        "affected_story_ids": [],
        "affected_claim_ids": []
      }
    ]
  },
  "sources": [
    {
      "source_id": "source-2026-10-13-001",
      "title": "arXiv preprint 2610.13651, original v1",
      "publisher": "arXiv / submitting research authors",
      "url": "https://arxiv.org/abs/2610.13651v1",
      "canonical_url": "https://arxiv.org/abs/2610.13651v1",
      "source_type": "primary_research",
      "is_primary_source": true,
      "published_at": null,
      "accessed_at": "2026-10-13T09:24:43.761-04:00",
      "supports_claim_ids": [
        "claim-mp-2026-10-13-001-001"
      ]
    }
  ],
  "corrections": [
    {
      "correction_id": "correction-2026-10-13-001",
      "revision": 2,
      "summary": "Publication note: The October 13, 2026 edition was prepared and published late on October 13 after the scheduled newsroom task could not start. It retains its October 13 edition date and 9:00 AM America/Detroit reveal time. Reports use evidence available before that cutoff; actual preparation and image-generation times are preserved in the provenance records.",
      "published_at": "2026-10-13T09:43:56.853-04:00",
      "affected_story_ids": [],
      "affected_claim_ids": []
    }
  ],
  "publisher": {
    "name": "The Machine Press",
    "url": "https://themachinepress.com",
    "description": "A daily newspaper for the age of artificial intelligence."
  },
  "cite_this_report": {
    "title": "A Fuzzer Finds Weaknesses in 343 AI Tools",
    "publisher": "The Machine Press",
    "published_at": "2026-10-13T09:00:00.000-04:00",
    "canonical_url": "https://themachinepress.com/story/mp-2026-10-13-001/a-fuzzer-finds-weaknesses-in-343-ai-tools"
  }
}