Researchers bypass 6 AI agent frameworks with a simple ‘Repeat-After-Me’ prompt
Researchers used a Repeat-After-Me prompt to make six AI agent frameworks run attacker-written tool calls.
Researchers from Pennsylvania State University, Université Montpellier, and Dartmouth College showed a Repeat-After-Me prompt can make six agent frameworks execute attacker-written tool calls. The affected projects were LangGraph, Microsoft Agent Framework, AutoGen, Google Agent Development Kit 2.0, AWS Strands Agents, and CrewAI. In a LangGraph 1.2.0 test with Llama 3.1 8B, the orchestrator dispatched a structured call despite a refusal instruction. Their ToFu fuzzer confirmed 253 bugs in 118 of 273 MCP servers, including path traversal, SSRF, data exfiltration, and command injection; in-the-wild exploitation was not reported.
66