The Debrief
L7L14L30L90All
PaidSearchIndustryTechDataBrandConversion
Tech · 2 min read13 July 2026

The Tools You Build for AI Agents Can Be Turned Against Them. Chrome Just Said So.

WebMCP lets websites expose structured tools that AI agents can call directly, and Search Engine Journal's warning is blunt: those tools give attackers a clean route to hijack the agents using them. Agent-readiness is about to be sold hard to businesses. Security discipline has to ship with it.

An agent cannot reliably tell your data from an attacker's instructions. Everything your site feeds it is executable until proven otherwise.

2 min read

Websites are starting to expose structured tools that AI agents can call directly through WebMCP, the browser-level implementation of the Model Context Protocol. Search Engine Journal's warning this weekend was blunt: the tools you publish on purpose hand attackers a clean, structured delivery route for hijacking the agents that use them.

Chrome's security guidance names two attack vectors. Malicious manifests, where a site's tool definitions carry hidden instructions designed to redirect the agent. Contaminated outputs, where the data a tool returns includes malicious instructions smuggled in from third-party content. Either way, the agent reads attacker text as operator commands.

The underlying weakness is architectural. Language models process instructions and data as one stream of tokens and cannot reliably tell them apart. Hidden text in metadata, white-on-white copy or an iframe can read as a command. Researchers have already catalogued runtime manipulation of agent tool surfaces in a dedicated arXiv paper on tool surface poisoning, and Chrome has published lockdown guidance for developers building on WebMCP.

Why it matters

Agent-readiness is about to be sold to Australian businesses the way mobile-readiness and SEO were. Exposing tools so agents can book an appointment, request a quote or check stock will be pitched as the new visibility, and the pitch is not wrong. Agents are becoming a genuine acquisition surface.

The risk is in the build quality. A poorly secured tool surface turns your website into the attack vector, and when a hijacked agent leaks a customer's data or takes a harmful action through your tools, the brand damage lands on you rather than on the agent vendor. Security is about to become a marketing dependency.

2

Attack vectors Chrome says every WebMCP implementation must defend against: malicious tool manifests and contaminated tool outputs (Chrome developer guidance)

What to do about it

If your developers or agency propose exposing agent tools, ask for the security model in writing: input validation, output sanitisation and least-privilege design per tool.
Keep high-consequence actions such as payments and account changes behind confirmation steps an agent cannot skip.
Treat third-party content on your site, including reviews, comments and embeds, as untrusted input that agents may consume.
Use Chrome's WebMCP security documentation as the baseline reference and revisit it as the spec evolves.

Agentic traffic is coming either way. The businesses that expose tools with real paranoia will collect the upside. The ones that rush it will learn why the paranoia was warranted.

Share this brief
Send it to a colleague who'll find it useful.
Filip Ivanković
The Debrief / From Filip Ivanković
One every morning. Six months in, you'll see the patterns most don't.
Strategy, benchmarks, and what's actually moving in Australian marketing. Four-minute read. The reps compound.
Filip Ivanković·Founder, New RebellionAboutLinkedIn