ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary
ToFu fuzzing found verified semantic bugs in 343 LLM tools across 118 MCP servers.
ToFu derives semantic security checks for LLM tools from existing metadata and a CWE-guided sanitizer corpus, then generates fuzzing harnesses and oracles. Across 273 MCP servers and 3,405 tools, it confirmed bugs in 343 tools on 118 servers. The authors conclude that real-world tools often fail to enforce documented input semantics, so LLM-generated arguments should not be treated as trusted.
- ToFu builds per-tool checks from metadata and a CWE sanitizer corpus.
- Evaluation covered 273 MCP servers and 3,405 tools.
- Verified bugs affected 343 tools across 118 servers.
- Many tools fail to enforce documented input semantics.
From the original article
1 min read at arxiv.orgLarge language models (LLMs) are increasingly deployed as agents that interact with external software through tools, with an orchestration layer translating model outputs into structured tool invocations. This architecture creates an LLM-orchestrator-tool trust boundary where tool semantics may go unenforced and LLM-generated arguments may be incorrectly treated as trusted.
By Md Nazmul Islam Ananto · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.