Repeat‑After‑Me Prompt Bypasses Six Major AI Agent Frameworks, Researchers Show

Overview

In a joint paper released on 9 October 2026, a team of academics from Penn State, the University of Montpellier and Dartmouth described a new adversarial technique called “Repeat‑After‑Me.” The method tricks AI‑orchestrated agents into running tool calls that the attacker supplies, effectively bypassing built‑in safety checks that are supposed to block unauthorised actions.

The researchers evaluated the technique against six widely adopted agent frameworks—LangChain / LangGraph, Microsoft Agent Framework, Microsoft AutoGen, Google Agent Development Kit 2.0, AWS Strands Agents and CrewAI. According to their experiments, all six platforms were vulnerable to the crafted prompt, demonstrating a systemic problem across the major vendors.

How the “Repeat‑After‑Me” Prompt Works

The attack starts with a seemingly harmless user request that contains the phrase “repeat after me:” followed by additional text. The large language model interprets this phrase as a literal instruction to echo the subsequent string verbatim. When the echoed string includes a tool‑call payload, the orchestration layer treats it as a genuine request and forwards it to the underlying tool without applying the usual sanitisation or verification steps.

In the LangGraph 1.2.0 demonstration, the model (Llama 3.1 8B via Ollama) initially refused the request but still emitted the raw tool‑call string. After a hypothetical reformulation of the prompt, the model produced a fully structured call that was executed before the refusal was processed, confirming that the exploit can succeed even when the model attempts to block the operation.

Scope of the Vulnerabilities

Beyond the prompt‑based bypass, the authors carried out a large‑scale fuzzing campaign on 273 open‑source multi‑tool orchestration (MCP) servers. They discovered 253 verified security bugs across 118 distinct servers, affecting a total of 343 separate tools that are commonly integrated into AI‑driven workflows.

The most severe findings break down into 64 path‑traversal flaws, 7 server‑side request forgery (SSRF) issues, 5 data‑leak incidents and 3 OS‑command injection vulnerabilities. The remaining bugs were primarily output or log injection problems, which can still be leveraged to manipulate downstream processes or exfiltrate information.

Introducing the ToFu Fuzzing Framework

To address these gaps, the researchers released ToFu, a fuzzing framework that automatically reads tool metadata, maps each capability to relevant CWE entries and generates targeted security checks. ToFu builds harnesses and semantic oracles by introspecting execution traces and sanitising the results, enabling systematic testing of thousands of tool instances.

• Automatic generation of fuzzing harnesses from tool specifications
• Semantic oracles built from execution introspection
• CWE‑based security control templates
• Batch testing of thousands of tool instances
• Reporting of verified bugs with reproducible payloads

The paper notes that many tools implicitly trust LLM outputs for input sanitisation, even when those inputs originate from other tools or external content. This implicit trust expands the attack surface, allowing chained exploits across multiple orchestrated components and making it difficult to isolate a single point of failure.

The maintainers of LangGraph were notified about the lack of pre‑execution controls, but no public response has been recorded from the teams behind LangChain, Microsoft, Google, AWS or CrewAI at the time of writing. The silence underscores the challenge of coordinating rapid patches across a fragmented ecosystem.

For English‑speaking organisations that rely on these agent frameworks, the findings mean that any LLM‑driven workflow that incorporates external tools must be assumed vulnerable until concrete mitigations are deployed. Immediate steps include disabling automatic tool execution, enforcing strict input validation outside the LLM, and integrating ToFu‑style fuzzing into the CI pipeline to surface hidden trust‑boundary flaws before they can be weaponised.

In Pennsylvania, where several of the study’s authors are based, university security offices have already begun reviewing internal deployments of LangChain and CrewAI. They are advising research labs and partner companies to apply the recommended mitigations while awaiting vendor patches, highlighting the real‑world urgency of the issue.