WebMCP-Phalanx blocks all 80 tool-description injections in a browser agent, then gets bypassed by a malicious tool name called before inspection

arXiv·high signalXBlueskyLinkedInCopy link

This 25 August paper (arXiv 2608.24017) attacks the W3C WebMCP proposal, which lets LLM agents invoke tools exposed by web pages, and finds the Same-Origin Policy leaves three gaps: subject-attribution spoofing, uncontrolled tool lifecycles, and semantic prompt injection. Their dual-layer runtime binds each tool to its registering principal with cryptographic capability credentials and splits inspection (a Quarantine LLM with no tool authority) from execution (a Privileged LLM), taking revocation and overwrite attack success from 100% to 0%, blocking all 80 description-embedded injections and limiting tool-return attacks to 2 of 80, with task utility statistically indistinguishable from baseline. The honest failure is the useful part: a white-box adaptive attacker bypasses description filtering via a malicious tool name invoked before inspection completes, which is why they propose a call-timing gate.