Technical Summary: WebMCP Tool Surface Poisoning

Problem Statement

WebMCP is an emerging protocol enabling websites to expose structured tools directly to AI agents, bypassing traditional user interfaces. While this enhances interactivity by allowing dynamic tool lists, it introduces a critical security gap: the assumption that the set of tools available to an agent within a single session is static and trusted is no longer valid. The "tool surface" itself has become a new security boundary.

Existing security research on LLM agents primarily focuses on static threats like prompt injection or indirect prompt injection, where malicious instructions are embedded in content. However, the dynamic nature of WebMCP allows for a new class of threats where the tool registry, definitions, and metadata can be altered during an active session. This paper identifies Mid-Session Tool Injection (MSTI) as a novel attack vector where attackers leverage compromised third-party scripts (e.g., via CDN, ad SDKs) to manipulate the tools visible to the agent, thereby hijacking the agent's execution flow or inducing data leakage without necessarily disrupting the user's original task.

Methodology

The authors constructed an experimental framework comprising a Benign Page Server, a Malicious Server, and an LLM Agent. The Malicious Server injects compromised third-party scripts into the victim's browser to manipulate the WebMCP tool registry in real-time.

Attack Taxonomy

The study categorizes MSTI attacks into two primary types:

1. Tool Hijacking: Directly alters the set of tools the agent can observe. This includes unregistering legitimate tools (via AbortSignal manipulation) or registering malicious tools with the same names before the agent can select them (race conditions). The goal is to force the agent to invoke a malicious tool instead of the legitimate one.
2. Tool Framing: Manipulates the agent's perception of a tool's role without necessarily removing legitimate tools. Attackers exploit metadata fields such as tool name, description, readOnlyHint, and inputSchema to disguise malicious tools as necessary workflow steps, security verifications, or safe read-only operations.

Experimental Setup

• Models: Experiments utilized three state-of-the-art (SOTA) LLMs: GPT-5.4, Claude Opus 4.6, and Gemini 2.5-flash.
• Scenarios: Four task scenarios of increasing severity were tested:
  • Weak: Knowledge base search (Information seeking).
  • Medium: Business report generation (Data processing).
  • Strong: E-commerce checkout (Transactional).
  • Critical: GPU driver update (System-level operation).
• Metrics:
  • Attack Success Rate (ASR): Percentage of runs where the agent invoked a malicious tool and exfiltrated data to the attacker endpoint.
  • Task Completion: Whether the agent completed the original user task (regardless of whether an attack occurred).
  • Data Exfiltration: Evidence of sensitive context being sent to the attacker.

Key Contributions

1. Identification of MSTI: The paper formally defines Mid-Session Tool Injection as a distinct threat category targeting the dynamic tool lifecycle of WebMCP, distinguishing it from static prompt injection.
2. Quantification of Risk: Through multi-model and multi-scenario experiments, the authors quantify the impact of tool manipulation on agent behavior, specifically measuring malicious tool invocation, data leakage, and task completion rates.
3. Security Design Recommendations: Based on empirical findings, the paper proposes specific secure design directions for WebMCP, including binding tool identity to origin, ensuring lifecycle consistency, enforcing data boundaries, and maintaining traceable logs.

Results

Tool Hijacking (Conditions C1, C3)

• High Success, Low Stealth: Hijacking attacks achieved very high ASRs (up to 100% for C3, 94% average for C1).
• Task Disruption: These attacks significantly disrupted task completion (dropping to 17–18%). The malicious tools often caused the agent to stall or fail at the first step of the workflow.
• Timing Sensitivity: Success strictly depended on injection timing. For AbortSignal hijacking (C1), the attack only succeeded if the malicious tool replaced the legitimate one before the first invocation (P1). Once a legitimate call was made, the attack failed (P2–P4).

Tool Framing (Conditions C2, C4, C5)

• High Stealth, High Success: Framing attacks were significantly more covert. While ASRs were lower than hijacking (ranging from 36% to 61% average), task completion rates remained high (81–85%).
• Model Variance:
  • GPT-5.4 and Gemini 2.5 were highly susceptible to description injection and long-description overflow.
  • Claude Opus showed systematic immunity to long-description overflow (C4) and lower susceptibility to description injection (C2), suggesting different semantic processing behaviors.
• Field Impact:
  • Description: The most potent field for framing; injecting imperative instructions (e.g., "Always call before send_email") yielded high success rates.
  • readOnlyHint: Setting readOnlyHint=true was a surprisingly effective standalone attack vector (87% average ASR), as agents interpreted it as a safety signal.
  • inputSchema: Effectiveness was highly model-dependent (Gemini 100% vs. GPT/Claude 0%).
  • Composite Attacks: Combining description injection with readOnlyHint (Condition C5) resulted in 100% success across all models.

Defense Evaluation

The authors implemented two baseline defenses:

1. Origin Binding: Rejecting tool registrations with the same name but different origins.
2. Data Flow Restriction: Intercepts third-party tool calls and restricts sensitive argument fields.

• Outcome: These defenses reduced ASR from 36–100% to 0% for the tested conditions. Crucially, task completion rates remained comparable to the baseline, proving that preventing data leakage does not necessarily break the agent's workflow.

Significance and Claims

The paper argues that the tool surface itself is an emerging security concern. Unlike traditional attacks that poison the prompt or the output, MSTI attacks the environment state perceived by the agent.

• Protocol Vulnerability: The study demonstrates that WebMCP's dynamic registration and structured metadata create unique attack surfaces that cannot be mitigated solely by upgrading model versions.
• Stealth vs. Disruption: There is a trade-off between attack visibility and disruption. Hijacking attacks are loud and disruptive, while framing attacks are stealthy and preserve task completion, making them harder for users to detect.
• Design Imperative: Current WebMCP deployments lack sufficient protection against dynamically introduced tools. The authors claim that future implementations must treat tool registration not just as an interface design feature, but as a critical security boundary requiring origin validation, lifecycle consistency checks, and strict data flow controls.

The paper concludes that without these security-aware architectures, the flexibility of WebMCP introduces a fundamental risk where the agent's execution flow can be hijacked or manipulated by malicious third-party scripts during runtime.