July 12, 2026 • Search Engine Journal
Chrome has published security guidance for WebMCP, the protocol that lets websites expose named tools directly to AI agents — and the warning is aimed at site owners, not agent builders, Search Engine Journal reports. The same tools that make a site agent-ready create a clean route for prompt injection, and Chrome’s core rule is blunt: only expose your tools to origins you trust.
Key takeaways
- WebMCP replaces agents guessing at your site’s markup with named tools they can call directly — which also makes those tools an attack surface.
- Chrome’s guidance identifies two attack vectors: malicious manifests (hidden instructions in tool names, parameters, or descriptions) and contaminated outputs (user-generated content carrying injected instructions back to the agent).
- Because LLMs process instructions and data as a single stream of tokens, agents cannot reliably tell legitimate data from embedded commands.
- Chrome recommends annotations —
untrustedContentHint,readOnlyHint, and anexposedToallowlist — plus threat-modeling every tool, capping description and output length, and requiring user interaction for sensitive actions.
What WebMCP changes
WebMCP is a proposal for making websites agent-ready. Instead of an AI agent inferring what a page does from its markup, the site publishes named tools the agent can call — search this catalogue, book this appointment, check this order. That directness is the appeal, and it is also the risk: a tool definition is text an agent reads and trusts, and the tool’s output flows straight into the agent’s context. It is the same shift toward agent-facing infrastructure seen in Safari’s new MCP server, arriving with sharper security stakes.
The two attack vectors Chrome flags
The first is the malicious manifest: hidden instructions embedded in a tool’s name, parameters, or description. An agent reading the manifest to decide how to use a tool can be steered by text the user never sees.
The second is contaminated output. A perfectly legitimate tool can return user-generated content — reviews, comments, forum posts, support replies — that contains injected instructions. The underlying problem, as the article puts it, is that LLMs treat all text, instructions and user data alike, as a single sequence of tokens. The model has no hard boundary between data it should summarize and commands it should follow.
Chrome’s recommended defenses
The guidance on developer.chrome.com centres on annotations. untrustedContentHint flags a payload that may include untrusted content, so agents apply extra scrutiny. readOnlyHint marks tools that don’t modify state, which helps agents decide when a user confirmation is needed before acting. exposedTo restricts which origins can call a tool at all — the allowlist behind the “only trusted origins” principle.
Beyond annotations, Chrome recommends threat-modeling every tool before deployment, keeping tool descriptions to roughly 500 characters and outputs to roughly 1,500, and using requestUserInteraction() so sensitive actions pause for a human.
What it means for small businesses
Agent-readiness is becoming part of the visibility conversation — Google’s own leadership expects search to become an AI agent manager, and agent traffic is already hitting sites on its own terms. WebMCP is one of the main proposals for meeting that traffic halfway. But any site with reviews, comments, or form-fed content that gets returned through a tool inherits the contaminated-output problem on day one.
The practical read for most local businesses: the fundamentals still come first. Clean structured data, fast pages, and content agents can parse — the core of technical SEO — deliver agent visibility today without new attack surface. When WebMCP tooling matures, adopting it is an AI strategy decision that should ship with Chrome’s checklist, not after it.
The ONmetrics Take
Agent-ready and secure are the same project. If you expose tools without annotations and origin restrictions, you have built the attack surface before you have built the benefit.
Three things stand out for London, Ontario businesses. First, user-generated content is now injection surface, not just content — reviews and comments that flow back through agent tools need the untrusted-content treatment. Second, small sites are not exempt: the attack targets the agent acting on a customer’s behalf, and a hijacked agent traced back to your site is a reputation problem regardless of your size. Third, most local businesses do not need WebMCP today — they need a site AI agents can already read and trust, which is a web design and technical SEO question before it is a protocol question.
Want to know whether your site is ready for AI agents — and whether your tracking would even show you agent traffic? Get a free digital marketing audit and we will map your AI-search visibility, technical gaps, and measurement blind spots.
Source
Original reporting: Search Engine Journal — “The WebMCP Tools You Expose To Agents Can Be Used To Hijack Them” (Slobodan Manic, July 12, 2026). https://www.searchenginejournal.com/the-webmcp-tools-you-expose-to-agents-can-be-used-to-hijack-them/579204/