{"id":9981,"date":"2026-10-12T12:07:30","date_gmt":"2026-10-12T12:07:30","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9981"},"modified":"2026-10-12T12:07:30","modified_gmt":"2026-10-12T12:07:30","slug":"researchers-bypass-6-ai-agent-frameworks-with-a-simple-repeat-after-me-prompt","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9981","title":{"rendered":"Researchers bypass 6 AI agent frameworks with a simple \u2018Repeat-After-Me\u2019 prompt"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Researchers have tricked six widely used AI agent frameworks into running tool calls written by an attacker, simply by asking the underlying model to repeat the call back.<\/p>\n

The technique, which the researchers call \u201cRepeat-After-Me,\u201d worked on LangChain\u2019s LangGraph, Microsoft Agent Framework, Microsoft\u2019s AutoGen, Google\u2019s Agent Development Kit 2.0, AWS\u2019 Strands Agents and CrewAI, according to researchers from Pennsylvania State University, Universit\u00e9 Montpellier and Dartmouth College.<\/p>\n

\u201cA seemingly benign text-repetition request thus gives the attacker direct control over the tool invocation and its arguments,\u201d the researchers wrote<\/a> in the paper.<\/p>\n

The same paper reports that a testing tool the team built found verified security bugs in 118 of the 273 open-source Model Context Protocol (MCP) servers it was able to run.<\/p>\n

How the trick works<\/h2>\n

In the demonstration, the researchers asked an AI model to repeat text formatted as a request to invoke a tool. The model initially refused the dangerous request but included the requested text in its response. The framework did not execute it at that stage.<\/p>\n

The researchers then framed the request as hypothetical and instructed the model to reproduce only the supplied text. The model emitted a structured tool invocation, which LangGraph dispatched. The simulated tool returned a result before the model issued another refusal.<\/p>\n

\u201cThe refusal text and the executed call disagree: the system prompt shaped what the model said, not what the orchestrator did,\u201d the researchers wrote.<\/p>\n

The researchers\u2019 findings do not show that every deployment of the six frameworks behaves this way.<\/p>\n

A refusal that came too late<\/h2>\n

The paper details one demonstration on LangGraph 1.2.0 running Meta\u2019s Llama 3.1 8B model through Ollama. The agent had two dummy tools, make_bomb and launch_missiles, which returned fixed data and had no real effect. Its only safeguard was a system prompt telling the model to decline dangerous requests.<\/p>\n

When first asked to repeat a launch_missiles call, the model refused but printed the call as text, and LangGraph ran nothing. The researchers then framed the request as hypothetical and told the model to output only the quoted call. This time the model returned the call in structured form, and LangGraph executed it at once with the attacker\u2019s arguments. The model\u2019s refusal arrived only after the tool had returned.<\/p>\n

\u201cThe system prompt shaped what the model said, not what the orchestrator did,\u201d the researchers wrote. They said they had reported the missing pre-execution check to the LangGraph maintainers.<\/p>\n

The paper includes a full transcript only for LangGraph. For the other five frameworks, it says the researchers reproduced the behavior but gives no further detail.<\/p>\n

LangChain, Microsoft, Google, AWS, and CrewAI did not immediately respond to requests for comment.<\/p>\n

Model output is not the permission<\/h2>\n

Vibhum Dubey, an independent security researcher and red teamer, said the finding points to an architectural weakness rather than a single bug.<\/p>\n

\u201cA model can generate a technically valid tool call that is still inappropriate for the task,\u201d Dubey said. \u201cIf the orchestration layer treats that output as sufficient authority to execute the operation, a model-level manipulation becomes a system-level security issue.\u201d<\/p>\n

How exploitable the technique is depends on what an attacker can influence and what the agent is allowed to do, he added. A read-only agent poses a different risk from one that can reach confidential files, change code repositories, or run commands.<\/p>\n

Tools left holding the risk<\/h2>\n

Because an attacker can dictate the arguments that reach a tool, the researchers argued that tools must validate their own inputs. They built ToFu, a fuzzing framework that reads each tool\u2019s description and checks whether the tool enforces the limits it advertises, such as staying inside a designated folder.<\/p>\n

After manual review, they confirmed 253 bugs affecting 343 tools across 118 servers. The most serious were 64 path-traversal flaws, seven server-side request forgery (SSRF) flaws, five data-exfiltration bugs, and three OS command-injection flaws. Most of the rest were reflected-output and log-injection issues, which the paper rates as lower impact in many deployments.<\/p>\n

The researchers wrote that \u201cmany tools implicitly rely on the LLM to sanitize inputs,\u201d even though prompts, retrieved content, and output from other tools can all influence those inputs.<\/p>\n

Separating the request from the authority<\/h2>\n

Dubey said the priority for security teams is to separate a model\u2019s ability to request an action from the system\u2019s authority to carry it out.<\/p>\n

\u201cEvery sensitive tool call should undergo independent authorization checks,\u201d he said. \u201cValid syntax or a convincing explanation from the model should never substitute for permission.\u201d<\/p>\n

He recommended running agents with restricted file and network access, isolated execution environments, and limited credentials, with explicit approval for sensitive or irreversible operations. Security teams should also monitor sequences of tool calls rather than judging each action in isolation, he said. <\/p>\n

The paper has not been peer-reviewed. The servers were tested at fixed code versions, and the paper does not say whether any of the flaws have since been fixed or exploited in the wild.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Researchers have tricked six widely used AI agent frameworks into running tool calls written by an attacker, simply by asking the underlying model to repeat the call back. The technique, which the researchers call \u201cRepeat-After-Me,\u201d worked on LangChain\u2019s LangGraph, Microsoft Agent Framework, Microsoft\u2019s AutoGen, Google\u2019s Agent Development Kit 2.0, AWS\u2019 Strands Agents and CrewAI, according […]<\/p>\n","protected":false},"author":0,"featured_media":9982,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9981","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9981"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9981"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9981\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9982"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9981"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9981"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9981"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}