add security and privacy considerations living document #55

victorhuangwq · 2025-11-14T23:58:23Z

No description provided.

victorhuangwq · 2025-11-15T00:12:53Z

initial draft based on discussion here: #45

will update it based on relevant discussions in the thread, as well as from TPAC before marking it as ready to merge.

khushalsagar

Looking good!

khushalsagar · 2025-11-18T23:01:30Z

docs/security-privacy-considerations.md

+Prompt injection represents a critical threat to WebMCP where malicious instructions are embedded in tool metadata, inputs, or outputs to manipulate agent behavior or compromise systems. Unlike traditional injection attacks, these exploits target the language model's interpretation of natural language rather than code execution vulnerabilities.
+
+**Key Risk Factors**:
+- No cryptographic verification of tool descriptions or schemas


I didn't follow this. how does cryptographic verification help?

I think the point I was trying make here was more about some form of "signing" of each tool, such that agents can be verified that it's the same trusted tool...

But I feel like this might not be relevant to prompt injection, might be an entirely new problem. Let me remove it for now.

khushalsagar · 2025-11-18T23:13:22Z

docs/security-privacy-considerations.md

+
+Malicious instructions embedded in tool parameters by compromised or malicious agents, targeting the website's own processing of tool inputs.
+
+- **Threat Actor**: Malicious users controlling or manipulating agents using WebMCP


This one is quite interesting. Definitely worth documenting but I think the onus is on the site as an "Agent provider". Every Agent provider has to mitigate against a common set of attacks when taking untrusted input. They likely have mitigations aside from WebMCP, the same tool could be exposed using an option in the Web UI.

Can you add something along these lines to the text? WebMCP doesn't expand the attack surface for this.

Yeah, I do agree that WebMCP doesn't expand the attack surface for input injection attacks. I'm incline to minimize attention on this issue at the moment.

Rethinking this, the bigger risk here is likely just that it WebMCP exposes another valuable target for attackers, if website owners implement valuable WebMCP actions on their site (e.g. reset password).

khushalsagar · 2025-11-19T04:35:46Z

docs/security-privacy-considerations.md

+
+#### Misalignment Types
+
+1. **Malicious misrepresentation** (fraud):


It's ambiguous what the site accomplishes from this attack, since it already has the ability to execute this action. Worth documenting that this is about deflecting blame/misattribution. Intentionally taking a harmful action which can be attributed to the Agent.

point taken, will clarify. It is indeed about intentionally trying to use the ambiguity to deflect blame to agent.

khushalsagar · 2025-11-19T04:36:32Z

docs/security-privacy-considerations.md

+   - Side effects not mentioned in the description
+   - Example: Tool deletes draft after sending email without mentioning this behavior
+
+3. **Ambiguous scope**:


This seems like a duplicate of 2), imprecise i.e. poorly written.

I will merge it with 2.

khushalsagar · 2025-11-19T04:50:43Z

docs/security-privacy-considerations.md

+- Are there specific attack scenarios from existing web security domains (CSRF, XSS, etc.) that apply to WebMCP in novel ways?
+- What risks emerge when combining WebMCP with other emerging web capabilities (Prompt API, Web AI, etc.)?
+
+### 2. Responsibility and Scope


I wouldn't say these are overarching open questions, it's just considerations for how to approach mitigations in this space.

I'd probably put something like this in the introduction: "Mitigations for any attack vector will need to consider all systems/entities involved: Site authors, Agent providers and browser vendors. While the spec can't define precise mitigation strategies that Agents/browser vendors must provide, the responsibilities for each system should be clearly defined. Common mitigations are documented as recommendations for Agents/browser vendors. We also explore these mitigations to inform additions to the Web API."

Make sense. I will add that to the introduction as well.

khushalsagar · 2025-11-19T04:55:13Z

docs/security-privacy-considerations.md

+- Should some tool categories require elevated permissions or review processes?
+- Related: [Issue #44 - Action-specific permission](https://github.com/webmachinelearning/webmcp/issues/44)
+
+### 4. Comparison with MCP


Similar here, can go into the section at the beginning which explains the overall approach. Something like: "It's likely that many mitigations to handle tools from untrusted sources will be common across MCP and WebMCP."

Because this is something we'll consider for every attack vector/mitigation.

Sounds good. Will do that

victorhuangwq

thanks for the review. will make changes accordingly, alongside the updates that I will be making to include points from TPAC and the current issue thread.

victorhuangwq · 2025-11-21T23:51:59Z

docs/security-privacy-considerations.md

+
+#### Misalignment Types
+
+1. **Malicious misrepresentation** (fraud):


point taken, will clarify. It is indeed about intentionally trying to use the ambiguity to deflect blame to agent.

victorhuangwq · 2025-11-21T23:52:49Z

docs/security-privacy-considerations.md

+   - Side effects not mentioned in the description
+   - Example: Tool deletes draft after sending email without mentioning this behavior
+
+3. **Ambiguous scope**:


I will merge it with 2.

victorhuangwq · 2025-11-21T23:53:46Z

docs/security-privacy-considerations.md

+- Are there specific attack scenarios from existing web security domains (CSRF, XSS, etc.) that apply to WebMCP in novel ways?
+- What risks emerge when combining WebMCP with other emerging web capabilities (Prompt API, Web AI, etc.)?
+
+### 2. Responsibility and Scope


Make sense. I will add that to the introduction as well.

victorhuangwq · 2025-11-21T23:53:58Z

docs/security-privacy-considerations.md

+- Should some tool categories require elevated permissions or review processes?
+- Related: [Issue #44 - Action-specific permission](https://github.com/webmachinelearning/webmcp/issues/44)
+
+### 4. Comparison with MCP


Sounds good. Will do that

initial commit

7946eb4

victorhuangwq marked this pull request as draft November 14, 2025 23:59

add toc

6c0b509

khushalsagar reviewed Nov 19, 2025

View reviewed changes

victorhuangwq commented Nov 21, 2025

View reviewed changes


		Malicious instructions embedded in tool parameters by compromised or malicious agents, targeting the website's own processing of tool inputs.

		- Threat Actor: Malicious users controlling or manipulating agents using WebMCP


		#### Misalignment Types

		1. Malicious misrepresentation (fraud):

add security and privacy considerations living document #55

Are you sure you want to change the base?

add security and privacy considerations living document #55

Conversation

victorhuangwq commented Nov 14, 2025

Uh oh!

victorhuangwq commented Nov 15, 2025

Uh oh!

khushalsagar left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

victorhuangwq Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

victorhuangwq left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

victorhuangwq Nov 21, 2025 •

edited

Loading