Source: Search Engine Journal
Chrome's security team has identified a critical vulnerability in WebMCP (a protocol for AI agents to access web services) that allows attackers to exploit the authenticated browser context where these agents operate—essentially using the user's logged-in sessions to compromise the agent's actions. This matters because AI agents are increasingly deployed to automate tasks like email, banking, and shopping on behalf of users, making browser hijacking a direct path to financial fraud and data theft. The vulnerability exposes a foundational design tension: giving AI agents useful access to web services requires them to inherit browser privileges, but that same inheritance becomes an attack surface.