WebMCP lets websites expose structured tools that AI agents can call directly, and Search Engine Journal's warning is blunt: those tools give attackers a clean route to hijack the agents using them. Agent-readiness is about to be sold hard to businesses. Security discipline has to ship with it.
An agent cannot reliably tell your data from an attacker's instructions. Everything your site feeds it is executable until proven otherwise.
Websites are starting to expose structured tools that AI agents can call directly through WebMCP, the browser-level implementation of the Model Context Protocol. Search Engine Journal's warning this weekend was blunt: the tools you publish on purpose hand attackers a clean, structured delivery route for hijacking the agents that use them.
Chrome's security guidance names two attack vectors. Malicious manifests, where a site's tool definitions carry hidden instructions designed to redirect the agent. Contaminated outputs, where the data a tool returns includes malicious instructions smuggled in from third-party content. Either way, the agent reads attacker text as operator commands.
The underlying weakness is architectural. Language models process instructions and data as one stream of tokens and cannot reliably tell them apart. Hidden text in metadata, white-on-white copy or an iframe can read as a command. Researchers have already catalogued runtime manipulation of agent tool surfaces in a dedicated arXiv paper on tool surface poisoning, and Chrome has published lockdown guidance for developers building on WebMCP.
Why it matters
Agent-readiness is about to be sold to Australian businesses the way mobile-readiness and SEO were. Exposing tools so agents can book an appointment, request a quote or check stock will be pitched as the new visibility, and the pitch is not wrong. Agents are becoming a genuine acquisition surface.
The risk is in the build quality. A poorly secured tool surface turns your website into the attack vector, and when a hijacked agent leaks a customer's data or takes a harmful action through your tools, the brand damage lands on you rather than on the agent vendor. Security is about to become a marketing dependency.
Attack vectors Chrome says every WebMCP implementation must defend against: malicious tool manifests and contaminated tool outputs (Chrome developer guidance)
What to do about it
Agentic traffic is coming either way. The businesses that expose tools with real paranoia will collect the upside. The ones that rush it will learn why the paranoia was warranted.