Researchers bypass 6 AI agent frameworks with a simple ‘Repeat-After-Me’ prompt

What happened

The same paper reports that a testing tool the team built found verified security bugs in 118 of the 273 open-source Model Context Protocol (MCP) servers it was able to run. Researchers have tricked six widely used AI agent frameworks into running tool calls written by an attacker, simply by asking the underlying model to repeat the call back.

The technique, which the researchers call “Repeat-After-Me,” worked on LangChain’s LangGraph, Microsoft Agent Framework, Microsoft’s AutoGen, Google’s Agent Development Kit 2.0, AWS’ Strands Agents and CrewAI, according to researchers from Pennsylvania State University, Université Montpellier and Dartmouth College. “A seemingly benign text-repetition request thus gives the attacker direct control over the tool invocation and its arguments,” the researchers wrote in the paper.

How the trick works In the demonstration, the researchers asked an AI model to repeat text formatted as a request to invoke a tool. The framework did not execute it at that stage.

Key facts

• The same paper — reports: that a testing tool the team built — found: verified security bugs in 118 of the 273 open-source Model Context Protocol (MCP) servers it was able to run