# ToFu researchers report security bugs in 343 tools across 118 MCP servers

_Published Monday, October 12, 2026 at 1:27 PM EDT · Science, Security · Latest · Tier 2 — Notable_

Researchers behind the ToFu preprint report finding verified security bugs in 343 tools across 118 MCP servers, after evaluating 273 servers containing 3405 tools. Their framework tests whether tools enforce their documented input requirements when software translates an AI model's outputs into tool calls.

ToFu derives security checks from tool metadata and a corpus of sanitizers organized by software weakness class. It tailors those checks to individual tools and automatically generates tests that probe their behavior. The researchers say their findings show that tools frequently fail to enforce documented input semantics, making model-generated arguments unsafe to treat as trusted.

## Sources

- [cs.CR updates on arXiv.org](https://arxiv.org/abs/2610.13651)

---
Canonical: https://techandbusiness.org/newswire/poAQGqvlZPFG0cReyFDp9K
Published: 2026-10-12T17:27:42.517Z
Story chronology: 2026-10-12T04:00:00.000Z
Retrieved: 2026-10-12T19:44:01.110Z
Publisher: Tech & Business (techandbusiness.org)