safety security
A Fuzzer Finds Weaknesses in 343 AI Tools
ToFu probes the handoff from a language model to external software. Its authors report verified bugs across 118 MCP servers.
Summary
ToFu probes the handoff from a language model to external software. Its authors report verified bugs across 118 MCP servers.
An agent's tool description can promise restrictions that the underlying software never enforces. ToFu, a new research framework, examines that gap between language-model output, orchestration and tool execution. It derives security checks from tool metadata and a corpus of known weakness patterns, then constructs fuzzing harnesses to test actual behavior. Across 273 MCP servers containing 3,405 tools, the authors report verified bugs in 343 tools spread across 118 servers. These are findings from the evaluated implementations, rather than a measured failure rate for every MCP deployment. The practical implication is clear: an orchestrator cannot safely grant model-generated arguments the status of trusted input. A natural-language description needs enforcement at the software boundary, where the requested operation actually happens. The paper supplies a systematic way to examine that boundary; production remediation still depends on the affected implementation.
Why it matters
ToFu probes the handoff from a language model to external software. Its authors report verified bugs across 118 MCP servers.
Limits and context
- The practical implication is clear: an orchestrator cannot safely grant model-generated arguments the status of trusted input.
Key claims
ToFu probes the handoff from a language model to external software. Its authors report verified bugs across 118 MCP servers.
Qualification: The practical implication is clear: an orchestrator cannot safely grant model-generated arguments the status of trusted input.
Evidence: source-2026-10-13-001
Sources
- arXiv preprint 2610.13651, original v1arXiv / submitting research authors · primary research
Corrections
: Publication note: The October 13, 2026 edition was prepared and published late on October 13 after the scheduled newsroom task could not start. It retains its October 13 edition date and 9:00 AM America/Detroit reveal time. Reports use evidence available before that cutoff; actual preparation and image-generation times are preserved in the provenance records.