AI Governance Institute
← News
Research2026-10-12

253 MCP Server Bugs and Six Framework Bypasses Expose Agent Authorization Gap

Source

Researchers bypass 6 AI agent frameworks with a simple 'Repeat-After-Me' prompt

Pennsylvania State University, Universite Montpellier, Dartmouth College

What happened

Researchers from three universities published findings, covered by CSO Online, showing that a prompt technique called Repeat-After-Me caused six major AI agent frameworks to carry out attacker-controlled tool calls. The affected frameworks include LangGraph, AutoGen, and Google's Agent Development Kit 2.0, all of which are used in enterprise deployments today. The underlying flaw is architectural: these orchestration layers trust whatever the AI model outputs as a valid instruction, rather than running an independent check before executing any action. ToFu was used to scan 118 open-source MCP (Model Context Protocol) servers. These are connectors that let AI agents access external systems such as databases, file stores, and cloud services. It found 253 verified security flaws. Some allow attackers to read or write files outside their intended scope. Others allow them to run arbitrary commands on the host system. This research builds on a pattern flagged in earlier coverage, including 68 MCP Server CVEs in One Month Expose a Systemic Agent Supply Chain Gap and Orchestration Framework Flaws Make AI Workflow Pipelines a Primary Attack Target.

Why it matters

  • ·Enterprises using any of the six affected frameworks may have no independent authorization check between an attacker's instruction and a live system action. A malicious prompt alone can trigger data exfiltration, file modification, or command execution without any human or system review.
  • ·The 253 flaws found across 118 open-source MCP servers represent a supply chain risk most AI governance programs have not inventoried. Organizations that cannot name which MCP servers are running cannot assess exposure to path-traversal or command-execution vulnerabilities that researchers have now confirmed at scale.
  • ·Regulators are paying close attention to agent authorization and containment failures. The EU AI Act (Regulation (EU) 2024/1689) and emerging guidance from bodies such as the Five Eyes treat failure to validate agent actions before execution as a control deficiency, and enforcement actions tied to agentic AI incidents are already on record in Europe.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

AGT-001Agent Permission BoundariesAGT-002Agent Prompt Injection DefenseAGT-005Human Approval Gate for Irreversible Agent ActionsAGT-019AI Tool and Plugin Supply Chain Risk AssessmentAGT-030MCP Server Inventory and Configuration Baseline

What to do now

  • ☐Ask your engineering or platform team to list every AI agent framework in use and confirm whether LangGraph, AutoGen, or Google's Agent Development Kit 2.0 is among them. If so, request a written assessment of whether an independent pre-execution authorization check exists before any tool call runs.
  • ☐Request a complete inventory of every MCP server connected to your AI systems, including open-source ones, and confirm whether any have been scanned for the classes of flaws the ToFu tool identified, specifically the ability to read or write files outside their intended area or run commands on the host system.
  • ☐Review your agent deployment approval process to confirm it requires an independent validation step before tool calls execute, not just a review of the model's instructions at the design stage.
  • ☐Update your third-party AI vendor due diligence questionnaire to require vendors to document their framework-level pre-execution validation controls and disclose which MCP servers their products connect to.
  • ☐Add prompt injection via tool outputs and framework-level authorization bypass to your next agent-specific tabletop exercise, so response owners understand what a Repeat-After-Me style attack looks like in practice.

What to watch next

Regulators and standards bodies are actively developing requirements around agent pre-execution authorization, and this research will likely accelerate that work. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services already names independent action validation as a baseline control. Enforcement bodies in the EU have shown willingness to treat agentic containment failures as formal regulatory events. Compliance teams should monitor whether affected framework vendors publish patches or architectural mitigations. They should also track whether MCP server inventories are added to scope in upcoming audit and penetration testing standards. The accumulating body of MCP vulnerability research, including the CIS MCP Benchmark Sets 55-Point Audit Baseline for Agent Tool Governance, signals that a point-in-time review will no longer satisfy auditors or regulators in this area.

Related Coverage

Research2026-10-27

AI Coding Tools Are Privileged Agents. Most Governance Programs Don't Treat Them That Way.

A BankInfoSecurity practitioner guide published October 26, 2026 details how attackers can hide malicious instructions inside code repositories, comments, configuration files, and tool descriptions. These hidden instructions can redirect AI coding assistants into stealing credentials or taking unauthorized actions. The guide recommends centrally managed deny rules, approved-tool allowlists, short-lived credentials, and mandatory human approval for sensitive operations. Most enterprise governance programs have not yet classified AI coding tools as the privileged, agent-class software they have become.

Corporate Policy2026-10-24

Email Prompt Injection Turns Trusted AI Agents Into Attack Tools

Gen Threat Labs published research showing AI agents can be redirected by malicious instructions embedded in ordinary email content, with no software flaw required. Gen Digital responded with the Agent Trust Hub, a layered security framework covering pre-installation scanning, encrypted agent connectivity, and runtime action interception. The accompanying AARTS open specification sets a proposed standard for agent runtime safety that enterprise teams can reference.

Research2026-10-28

Six Named AI Attack Techniques Show Governance Programs Are Targeting the Wrong Threat

CSO Online has cataloged ten attack techniques used against enterprise AI infrastructure. These include a fake MCP server impersonating Postmark and malware hiding attacker commands inside the OpenAI Assistants API. CVE-2025-32711 is a flaw in Microsoft 365 Copilot that lets attackers steal data via email. The real attack surface has shifted to AI tooling, agent permissions, and supply chain integrity. Most enterprise AI governance programs remain focused on model-level risks and have not kept pace.