WebMCP Browser-Agent Trust Boundary Weaknesses (Tool Spoofing, Lifecycle Abuse, Semantic Prompt Injection)

Technical Analysis

WebMCP lets web pages register tools an LLM agent can invoke, but browser trust is anchored on Same-Origin Policy, which does not model tool provenance, ownership, or lifecycle for agent-callable capabilities. This enables three concrete issues: (1) subject-attribution spoofing, where a malicious page impersonates or overwrites another origin's registered tool; (2) uncontrolled tool lifecycles, allowing revocation/overwrite attacks that hijack previously trusted tool bindings; and (3) semantic prompt injection embedded in tool names, descriptions, or return values that the agent ingests as trusted context. The entry point is any web page able to register or modify WebMCP tools or influence tool metadata/output seen by the agent; a successful attack lets the attacker's page redirect agent behavior or exfiltrate/execute actions under the privileged agent's authority. The paper's own adaptive white-box finding shows that filtering based on tool description content can still be bypassed by malicious tool names invoked before semantic inspection completes, revealing a call-timing race across the quarantine/privileged agent boundary.

Affected Systems

WebMCP (W3C proposal), browser-integrated LLM agent runtimes; protocols: WebMCP, MCP

Detection Signatures

• Tool registrations that overwrite or revoke existing tool bindings from a different origin without cryptographic provenance verification
• Tool descriptions or metadata containing embedded natural-language instructions directed at an LLM (e.g., imperative phrasing, role-override language, or system-prompt-like content)
• Tool names that differ suspiciously from their description/semantics or contain instruction-like strings
• Tool invocation occurring before full metadata/description validation completes (call-timing race)
• Unexpected tool output content that includes directive language rather than data

Remediation Steps

1. 1

   Bind tools to cryptographic principal identity

   Require WebMCP tool registration to include capability credentials cryptographically tied to the registering origin, and propagate provenance labels through the full tool lifecycle to prevent spoofing, revocation, and overwrite attacks.

2. 2

   Separate semantic inspection from privileged execution

   Adopt a dual-agent architecture where a non-privileged quarantine agent inspects tool metadata, descriptions, and outputs for injection before a separate privileged agent is allowed to invoke tools, keeping the inspector's internal state hidden from page scripts.

3. 3

   Enforce a call-timing gate

   Delay any tool invocation until all agent-visible tool metadata (including tool names, not just descriptions) has been validated, closing the race condition where malicious names bypass description-based filters.

4. 4

   Validate tool names as untrusted input

   Apply the same injection-detection scrutiny to tool names/identifiers as to descriptions and outputs, since the paper shows names alone can carry adversarial payloads.

5. 5

   Monitor tool lifecycle events

   Log and alert on tool registration, overwrite, and revocation events across origins to detect anomalous lifecycle manipulation before it reaches production agent runtimes.