ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary

Summary

Researchers present ToFu, a framework that derives semantic security checks for LLM tools from existing metadata and a CWE-guided sanitizer corpus, then generates fuzzing harnesses and semantic oracles for each tool. Evaluated across 273 MCP servers containing 3405 tools, ToFu found verified bugs matching CWE weakness classes in 343 tools across 118 servers. The findings show real-world tools often fail to enforce their documented input semantics, so LLM-generated arguments should not be treated as trusted.

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-108759: mistral.rs sandbox escape via symlinks in mistralrs-code-execSimilar attack · NVD/CVE Database
• MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySimilar attack · NVD/CVE Database
• MediumCVE-2026-108574: BerriAI LiteLLM authorization bypass in session spend log view via session_idSimilar attack · NVD/CVE Database
• MediumCVE-2026-108670: JeecgBoot missing authorization in AiragPromptsControllerSimilar attack · NVD/CVE Database
• MediumCVE-2026-108600: open-multi-agent link following flaw in file_write tool sandboxSimilar attack · NVD/CVE Database