--- title: Researchers bypass 6 AI agent frameworks with a simple... description: Researchers from Penn State, Université Montpellier, and Dartmouth College found that six popular AI agent frameworks — LangChain's LangGraph, Microsoft Agent... canonical: https://daily.dev/posts/researchers-bypass-6-ai-agent-frameworks-with-a-simple-repeat-after-me-prompt-lncntiav7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Researchers bypass 6 AI agent frameworks with a simple ‘Repeat-After-Me’ prompt | daily.dev og:description: Researchers from Penn State, Université Montpellier, and Dartmouth College found that six popular AI agent frameworks — LangChain's LangGraph, Microsoft Agent... og:url: https://daily.dev/posts/researchers-bypass-6-ai-agent-frameworks-with-a-simple-repeat-after-me-prompt-lncntiav7 og:image: https://api.daily.dev/og/posts/LNcNtIAv7.png og:image:alt: Researchers bypass 6 AI agent frameworks with a simple ‘Repeat-After-Me’ prompt og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Researchers bypass 6 AI agent frameworks with a simple ‘Repeat-After-Me’ prompt **[CSO Online](https://daily.dev/sources/csoonline)** · 5 min read · 0 upvotes · 0 comments ## Summary Researchers from Penn State, Université Montpellier, and Dartmouth College found that six popular AI agent frameworks — LangChain's LangGraph, Microsoft Agent Framework, Microsoft AutoGen, Google's Agent Development Kit 2.0, AWS Strands Agents, and CrewAI — can be tricked into executing attacker-controlled tool calls via a 'Repeat-After-Me' prompt. By framing a dangerous tool invocation request as hypothetical text to repeat, the model outputs a structured tool call that the orchestration layer executes, even though the model separately issues a refusal. A demonstration on LangGraph 1.2.0 with Llama 3.1 8B showed the agent executing a dummy 'launch_missiles' tool call before the model's refusal text appeared. The same research team built a fuzzing tool called ToFu and found 253 verified security bugs across 118 of 273 tested open-source MCP servers, including 64 path-traversal flaws, 7 SSRF bugs, 5 data-exfiltration bugs, and 3 OS command-injection flaws. Experts recommend treating model output as a request, not authorization, requiring independent authorization checks for sensitive tool calls. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Repeat-After-Me attack on AI agent frameworks? It is a prompt injection technique where an attacker frames a dangerous tool-call request as hypothetical text for the model to repeat, causing the model to emit a structured tool invocation that the orchestrator executes even though the model also issues a refusal. It was demonstrated against LangGraph, Microsoft Agent Framework, AutoGen, Google ADK 2.0, AWS Strands Agents, and CrewAI. _Teams hardening agent pipelines against prompt injection can track emerging research like this on daily.dev._ ### How many security bugs did researchers find in open-source MCP servers? Researchers confirmed 253 verified security bugs affecting 343 tools across 118 of 273 tested open-source Model Context Protocol servers, using a fuzzing framework called ToFu. The most serious included 64 path-traversal flaws, 7 server-side request forgery bugs, 5 data-exfiltration bugs, and 3 OS command-injection flaws, with the rest mostly lower-impact reflected-output and log-injection issues. _Developers building MCP servers can follow coverage of vulnerability research on daily.dev to avoid these pitfalls._ ### Why did LangGraph execute a dangerous tool call even after the model refused it? Because the orchestrator treated the model's structured tool-call output as sufficient authority to execute, regardless of the accompanying refusal text. In a demonstrated case on LangGraph 1.2.0 with Llama 3.1 8B, the model printed a refusal as text first, then under a hypothetical framing emitted a structured launch_missiles call that LangGraph executed immediately, with the model's actual refusal arriving only after the tool had already run. _Developers wiring up agent orchestration can follow security findings like this on daily.dev before shipping tool-calling agents._ ## Similar posts on daily.dev - [we are building data breach machines and nobody cares](https://daily.dev/posts/we-are-building-data-breach-machines-and-nobody-cares-qcskpagwt) · Hacker News · 3 upvotes · 0 comments - [The Attack Chain Your AI System is Already Missing](https://daily.dev/posts/the-attack-chain-your-ai-system-is-already-missing-q1wezofvf) · Security Boulevard · 0 upvotes · 0 comments - [The Multi-Agent Trap](https://daily.dev/posts/the-multi-agent-trap-gcmbn0u9m) · Towards Data Science · 1 upvotes · 0 comments --- Tags: [#mcp](https://daily.dev/tags/mcp), [#appsec](https://daily.dev/tags/appsec), [#langchain](https://daily.dev/tags/langchain), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/researchers-bypass-6-ai-agent-frameworks-with-a-simple-repeat-after-me-prompt-lncntiav7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Researchers bypass 6 AI agent frameworks with a simple ‘Repeat-After-Me’ prompt","url":"https://daily.dev/posts/researchers-bypass-6-ai-agent-frameworks-with-a-simple-repeat-after-me-prompt-lncntiav7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/researchers-bypass-6-ai-agent-frameworks-with-a-simple-repeat-after-me-prompt-lncntiav7"},"datePublished":"2026-10-12T12:10:12.612Z","dateModified":"2026-10-12T12:30:50.452Z","description":"Researchers from Penn State, Université Montpellier, and Dartmouth College found that six popular AI agent frameworks — LangChain's LangGraph, Microsoft Agent...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/82ae669c3e9ea7f2de1c3b3c115aadaf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/82ae669c3e9ea7f2de1c3b3c115aadaf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/researchers-bypass-6-ai-agent-frameworks-with-a-simple-repeat-after-me-prompt-lncntiav7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"mcp,appsec,langchain,prompt-injection","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Researchers bypass 6 AI agent frameworks with a simple ‘Repeat-After-Me’ prompt"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/researchers-bypass-6-ai-agent-frameworks-with-a-simple-repeat-after-me-prompt-lncntiav7#faq","mainEntity":[{"@type":"Question","name":"What is the Repeat-After-Me attack on AI agent frameworks?","acceptedAnswer":{"@type":"Answer","text":"It is a prompt injection technique where an attacker frames a dangerous tool-call request as hypothetical text for the model to repeat, causing the model to emit a structured tool invocation that the orchestrator executes even though the model also issues a refusal. It was demonstrated against LangGraph, Microsoft Agent Framework, AutoGen, Google ADK 2.0, AWS Strands Agents, and CrewAI. Teams hardening agent pipelines against prompt injection can track emerging research like this on daily.dev."}},{"@type":"Question","name":"How many security bugs did researchers find in open-source MCP servers?","acceptedAnswer":{"@type":"Answer","text":"Researchers confirmed 253 verified security bugs affecting 343 tools across 118 of 273 tested open-source Model Context Protocol servers, using a fuzzing framework called ToFu. The most serious included 64 path-traversal flaws, 7 server-side request forgery bugs, 5 data-exfiltration bugs, and 3 OS command-injection flaws, with the rest mostly lower-impact reflected-output and log-injection issues. Developers building MCP servers can follow coverage of vulnerability research on daily.dev to avoid these pitfalls."}},{"@type":"Question","name":"Why did LangGraph execute a dangerous tool call even after the model refused it?","acceptedAnswer":{"@type":"Answer","text":"Because the orchestrator treated the model's structured tool-call output as sufficient authority to execute, regardless of the accompanying refusal text. In a demonstrated case on LangGraph 1.2.0 with Llama 3.1 8B, the model printed a refusal as text first, then under a hypothetical framing emitted a structured launch_missiles call that LangGraph executed immediately, with the model's actual refusal arriving only after the tool had already run. Developers wiring up agent orchestration can follow security findings like this on daily.dev before shipping tool-calling agents."}}]} ```