ToFu: exploiting and fuzzing the trust boundary between LLM orchestrators and tools

The researchers propose ToFu, a fuzzing framework for LLM tools, which automatically derives semantic security checks from tool metadata and a CWE-guided sanitizer corpus, and generates schema-conforming fuzzing harnesses and semantic oracles. After evaluating on 273 MCP servers and 3405 tools, ToFu confirmed 253 reproducible defects in 343 tools across 118 servers, including 115 reflected output, 64 path traversal, 58 log injection, 7 SSRF, etc. These defects mostly occur when tools return normally and do not manifest as crashes. The authors also propose the Repeat-After-Me attack, which induces the LLM to verbatim repeat attacker-constructed tool call text, and the orchestration layer dispatches and executes it as a request, showing that conforming to the tool call schema does not mean the request is trustworthy.

Paper analysis in progress