Researchers bypass 6 AI agent frameworks with a simple ‘Repeat-After-Me’ prompt
Researchers have tricked six widely used AI agent frameworks into running tool calls written by an attacker, simply by asking the underlying model to repeat the call back. The technique, which the researchers call “Repeat-After-Me,” worked on LangChain’s LangGraph, Microsoft…
No other outlet followed by Zonactu reports this story yet.
How exploitable the technique is depends on what an attacker can influence and what the agent is allowed to do, he added. A read-only agent poses a different risk from one that can reach confidential files, change code repositories, or run commands.
Because an attacker can dictate the arguments that reach a tool, the researchers argued that tools must validate their own inputs. They built ToFu, a fuzzing framework that reads each tool’s description and checks whether the tool enforces the limits it advertises, such as staying inside a designated folder.
After manual review, they confirmed 253 bugs affecting 343 tools across 118 servers. The most serious were 64 path-traversal flaws, seven server-side request forgery (SSRF) flaws, five data-exfiltration bugs, and three OS command-injection flaws. Most of the rest were reflected-output and log-injection issues, which the paper rates as lower impact in many deployments.
