ToFu finds that LLM tool servers trust arguments they should not
A research paper posted to arXiv shows that real-world tools frequently fail to enforce their documented input semantics, making it unsafe to treat LLM-generated arguments as trusted. The paper, titled ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary, introduces a framework that automatically derives semantic security checks from tool metadata and a CWE-guided sanitizer corpus. The evaluation across 273 MCP servers containing 3405 tools identified verified bugs corresponding to CWE weakness classes in 343 tools across 118 of the servers.
The architecture described involves large language models acting as agents that interact with external software through tools, with an orchestration layer translating model outputs into structured tool invocations. This creates an LLM-orchestrator-tool trust boundary where tool semantics may go unenforced and LLM-generated arguments may be incorrectly treated as trusted. The orchestration layer supplies the LLM with a user prompt alongside descriptions and input schemas of available tools. The LLM uses this information to reason about the prompt, plan actions, and generate structured tool calls specifying tool names and arguments. The layer executes these calls and returns their results as observations, allowing the LLM enabling agents to autonomously perform complex tasks.
The ToFu framework specializes semantic security checks to individual tools using runtime introspection and outcome sanitization. It automatically generates fuzzing harnesses and semantic oracles to detect when tools misbehave. The evaluation found that real-world tools frequently fail to enforce their documented input semantics.
The tool's schema defines the shape of valid arguments; its documentation, if present, defines safe values. The orchestration layer relies on the schema. The tool's own code must enforce the semantics. When the tool assumes its caller has already validated the arguments, no party performs semantic validation.
The design decision that enables this outcome is the separation of syntactic validation from semantic enforcement. The orchestration layer handles syntactic validation because it can be automated against the tool's published interface. Semantic enforcement is left to the tool because it requires context-specific logic that would make the orchestration layer unmanageably complex if generalized. The trade-off is between integration friction and defense in depth: requiring each tool to reimplement validation against a common schema duplicates work the orchestration layer appears to have done; requiring the orchestration layer to understand each tool's runtime semantics would make the protocol too complex. The result is a protocol that standardizes syntax and leaves semantics to the tool, with no mechanism ensuring the tool actually enforces them.
The ToFu framework shifts the cost by automating the derivation of semantic checks from metadata and runtime behavior. It generates fuzzing harnesses that preserve schema validity while probing semantic boundaries and uses outcome sanitization to detect misbehavior. This exposes the assumption that the orchestration layer provides protection. The protocol does not expose validation failures to callers in a way that would penalize lax tools. A tool that executes unsafely on malformed input returns the same success channel as a tool that properly rejects bad arguments.
If a system separates syntactic protocol compliance from semantic contract enforcement, and if downstream components assume upstream components have performed work those components cannot perform, then attacker-controlled content that passes syntax checks will reach semantic execution with no further obstacle. The evaluation shows this configuration is not exceptional: more than one in ten tools in the broad sample failed this boundary. The open question is whether protocol designers will add mandatory semantic attestation—requiring tools to declare what they check—or whether the cost of integration friction will continue to push validation inward, onto tool authors who have already shown they will not bear it.