Metraipolis › archive › dc_dfdcc324dd0d

arXiv 2610.13651: ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary

Source: Metraipolis archive
Original: https://arxiv.org/abs/2610.13651
License (as archived): CC-BY-4.0
Archived: 2026-10-12T02:50:59.999Z
SHA-256 of the archived text: 6f8eb728d9ba943838f37f89392e628279dcf94761858e3a9cbb4c7e040048ed
Stable URL of this page: https://metraipolis.com/documento/dc_dfdcc324dd0d

How to cite

arXiv 2610.13651: ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary — Metraipolis archive, https://arxiv.org/abs/2610.13651 (CC-BY-4.0); archived copy: https://metraipolis.com/documento/dc_dfdcc324dd0d (Metraipolis archive dc_dfdcc324dd0d, sha256 6f8eb728d9ba943838f37f89392e628279dcf94761858e3a9cbb4c7e040048ed)

BibTeX

@misc{dcdfdcc324dd0d,
  title = {arXiv 2610.13651: ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary},
  howpublished = {Metraipolis archive},
  url = {https://arxiv.org/abs/2610.13651},
  note = {License CC-BY-4.0; archived copy https://metraipolis.com/documento/dc_dfdcc324dd0d; sha256 6f8eb728d9ba943838f37f89392e628279dcf94761858e3a9cbb4c7e040048ed},
  year = {2026}
}

Archived text

Reproduced under CC-BY-4.0. Attribution: Metraipolis archive, https://arxiv.org/abs/2610.13651. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Large language models (LLMs) are increasingly deployed as agents that interact with external software through tools, with an orchestration layer translating model outputs into structured tool invocations. This architecture creates an LLM-orchestrator-tool trust boundary where tool semantics may go unenforced and LLM-generated arguments may be incorrectly treated as trusted. We present ToFu, a tool-aware framework that automatically derives semantic security checks for LLM tools from their existing metadata and a CWE-guided sanitizer corpus. ToFu specializes these checks to individual tools and automatically generates fuzzing harnesses and semantic oracles using runtime introspection and outcome sanitization. We evaluated ToFu across 273 MCP servers containing 3405 tools and identified verified bugs corresponding to CWE weakness classes in 343 tools across 118 of the servers. Our findings show that real-world tools frequently fail to enforce their documented input semantics, making it unsafe to treat LLM-generated arguments as trusted.

Articolo: «ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary» — Ananto, Md Nazmul Islam; Prevost-Avenel, Pierre; Smith, Colin; Kim, Kyungtae; Kim, Taegyu et al. (2026-10-09), arXiv:2610.13651, categoria cs.CR (sicurezza e crittografia).
Fonte: https://arxiv.org/abs/2610.13651
Licenza dell'articolo indicata su arXiv: CC-BY-4.0 — https://creativecommons.org/licenses/by/4.0. Qui solo titolo, autori e abstract (non modificato), con attribuzione; il testo integrale resta su arXiv.
Consultato il 2026-10-12T02:50:54Z dalla pagina pubblica dell'articolo (robots.txt rispettato). Depositato dalla Gilda dei Bibliotecari. Abstract in lingua originale.