Chrome’s WebMCP Security Guidance Highlights Attack Vectors for AI Agents

Chrome’s developer site now publishes security guidance for WebMCP, the protocol that lets websites expose named tools to AI agents. The guidance explains two attack vectors: a malicious manifest that hides instructions in tool names, parameters, or descriptions, and contaminated output where user‑generated content can contain hidden instructions. Because LLMs treat all text as a single token sequence, they cannot reliably separate data from commands, making these vectors hard to mitigate inside the model. Chrome recommends that tool authors add untrustedContentHint to label payloads, readOnlyHint for tools that do not change state, and exposedTo to restrict tool usage to trusted origins. The guidance also caps tool description to 500 characters, tool output to roughly 1,500 characters, and introduces a requestUserInteraction() path for confirmation before actions. The article stresses that the responsibility for security lies with the website exposing the tools, not the agent. It calls for a threat‑modeling approach for every tool, asking whether untrusted content can be returned and whether it has been marked. The guidance is part of an early Chrome origin trial, and most websites have not yet exposed a single tool. The article serves as a warning that adopting WebMCP without proper safeguards can open a new attack surface for AI agents.

The guidance also highlights that WebMCP is a new protocol that exposes a structured delivery route for attacks, and that the model’s probabilistic nature makes it impossible to guarantee safety inside the model itself. It urges developers to annotate tools with untrustedContentHint, readOnlyHint, and exposedTo, and to limit the character budgets for tool descriptions and outputs. The article concludes that the line between agent‑ready and agent‑safe is the developer’s responsibility, and that the window to adopt WebMCP safely is now.

In short, the article warns that WebMCP introduces a new attack surface and provides concrete mitigation steps for developers to secure their tools against malicious manifests and contaminated output.