AI agent executes tool its model says it refuses

The refusal comes after execution. In the demonstration accompanying ToFu, a preprint posted on 9 October 2026, an agent calls a dummy tool then declares it cannot fulfil the request. The work of six researchers examines what happens between the model's output, the program that triggers the action and the tool that carries it out.

The authors say they reproduced their "Repeat-After-Me" attack on six orchestrators, but only publish a full demonstration for LangGraph. Their second result is a benchmark that found 253 security bugs, verified by them, in 118 open-source MCP (Model Context Protocol) servers.

When repetition becomes a tool call

The model produces the name of a tool and its arguments; the orchestrator decides how to handle this structured call. In the scenario studied, the attacker knows the expected format and asks the model to copy a call they have written. The issue is the transition from this instruction to an actual tool call. A string displayed in the free-text response is not enough to trigger execution in the published demonstration.

The authors say they reproduced this behaviour on LangGraph, Microsoft Agent Framework, Google ADK 2.0, AutoGen, AWS Strands and CrewAI. The paper does not detail the versions tested for each: only the LangGraph demonstration is published in full.

The LangGraph demonstration

Appendix B of the preprint describes the setup. LangGraph 1.2.0, its ready-to-use tool execution node (ToolNode), the Llama 3.1 8B model served by Ollama at zero temperature, and two dummy tools with no effect, make_bomb and launch_missiles, which return a fixed list. The only protection is a system prompt asking to refuse any dangerous request.

On the first turn, the model refuses and copies the call in its response as plain text: nothing executes. On the second, the attacker presents the same request as "hypothetical" and demands that the model produce nothing other than the quoted string. The model then returns an empty message accompanied by a structured call to launch_missiles with exactly the arguments written by the attacker, and ToolNode executes it immediately. The refusal only appears after the tool returns. "The system prompt shaped what the model said, not what the orchestrator did," the authors summarise.

The setup remains favourable to the attacker: a local 8-billion-parameter model, a tool and format known in advance, and a system prompt as the only protection. The paper does not measure the success rate on more robust models. In the tested configuration, no independent authorisation control intercepts the call before execution.

253 bugs in MCP servers that trust the model

The second part of the work draws the consequence of this observation. If an attacker can dictate the arguments, via the user's prompt, retrieved content or the output of another tool, then each argument must be treated as hostile when it reaches the tool. ToFu therefore starts from the metadata that MCP servers already expose to the model (tool description, meaning of each argument) to infer security controls. An argument described as "file in the workspace" should not allow reading ../../etc/passwd. ToFu then generates adversarial inputs and checks at execution whether the promise is kept, using 74 detectors, most linked to a CWE weakness class.

The researchers tested 273 Python or JavaScript servers, representing 3,405 extracted tools of which only a part could be exercised. After manual verification and removal of duplicates, they retain 253 reproducible bugs in 118 servers. These results apply to the selected corpus and do not give a vulnerability rate for the entire MCP ecosystem.

The most numerous flaws concern outputs that reproduce input without escaping it, path traversals allowing access to files outside the perimeter, and log injections. The corpus also includes diverted network requests, exfiltrations and three system command injections.

These flaws can manifest without crashing, thus escaping a test that only monitors program stops. The authors notably report access to files outside the intended space, file deletion and closure of terminal sessions that did not belong to the tested tool.

A problem of default settings

Ticket #8817, opened on 4 September by the first author, Nazmul Islam Ananto, takes up the scenario. It asks for a documented interception point before execution or an explicit warning about the tool node's behaviour. As of 16 October, the ticket remains open.

Controls already exist. The ToolNode code in langgraph-prebuilt 1.1.0, the minimum version required by LangGraph 1.2.0, offers the optional parameter wrap_tool_call to intercept a call and refuse to execute it. CrewAI also provides a hook before the call capable of blocking it. These mechanisms must be configured. The code in the LangGraph ticket, however, uses a custom node that executes the calls emitted by the model.

For a team deploying agents, the consequence is concrete: authorisation must be checked on the tool and its arguments, independently of the text produced by the model. The controls offered by frameworks provide an interception point; tools must additionally validate themselves the files, network destinations and operations they accept. A call conforming to the schema can request an action that the user is not allowed to perform.

Version 1 of ToFu tests tools call by call. It does not cover sequences of actions that depend on state, exchanges between multiple agents, or flaws without observable effect at execution.

Add ActuIA to my preferred sources on Google

Our articles will then appear first in Google Top Stories.