CSO OnlineHigh Impact
Simple 'Repeat-After-Me' Trick Made Six AI Agent Frameworks Run Attacker Tool Calls
The short answer
Researchers got LangGraph, Microsoft's agent frameworks, Google's ADK, AWS Strands and CrewAI to execute tool calls written by an attacker. The lesson is the one we teach: the model saying no is not the same as the system blocking the action.
- security
- AI agents
- prompt injection
What happened
CSO Online reports the study also found 253 verified bugs across 118 open-source MCP servers, including path-traversal and command-injection flaws. The paper has not been peer-reviewed.
What it means for your business
The lesson is the one we teach: the model saying no is not the same as the system blocking the action. Sensitive actions need a separate approval check.
Source: CSO Online