ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary
A fuzzer found semantic security bugs in 343 tools across 118 of 273 real-world MCP servers tested.
Researchers introduce ToFu, a framework that automatically derives security checks from MCP tool metadata and fuzzes tools to find cases where documented input semantics aren't actually enforced. Testing 273 open-source MCP servers (3,405 tools), they found verified bugs tied to known CWE weakness classes in 343 tools spanning 118 servers, showing that LLM-generated tool arguments are frequently trusted when they shouldn't be.
Why it matters
This is concrete evidence that the trust boundary between an LLM orchestrator and the tools it calls is weakly enforced in practice across a large sample of real MCP servers, not a theoretical concern. As agentic tool-use becomes the default way LLMs act on systems, unenforced tool semantics is a direct path to injection, privilege misuse and data exposure in deployed agents.
What is verified
Researchers built ToFu, a framework that automatically derives semantic security checks and fuzzing harnesses for LLM tools from tool metadata and a CWE-guided sanitizer corpus. [1]
ToFu was evaluated across 273 open-source MCP servers containing 3405 tools. [1]
The evaluation found verified semantic security bugs corresponding to CWE weakness classes in 343 tools across 118 of the 273 servers (the paper comments note 253 verified bugs in 118 servers). [1]
The paper's core finding is that real-world MCP tools frequently fail to enforce their documented input semantics, meaning LLM-generated arguments cannot safely be treated as trusted. [1]
What is not
- The abstract and the submission comments give slightly different bug counts (343 tools/118 servers vs 253 verified bugs in 118 servers), and the exact severity or exploitability of the identified CWE classes is not detailed in the supplied
- No information on which specific MCP servers or tool categories were most affected, or whether any of the flagged servers are widely used in production agent deployments.
- The paper is a preprint (submitted Oct 2026) and has not been independently replicated or peer reviewed per the supplied evidence.
- No remediation guidance, disclosure timeline, or vendor response is described in the evidence.
Sources
- 1arXiv cs.CRarxiv.org · Primary source
Original source published 9 October 2026 at 16:27.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.