ChatGPT can call WebMCP tools directly on web pages

OpenAI Devs said on August 26 that WebMCP works inside the ChatGPT desktop app's built-in browser and in ChatGPT Sites, per OpenAI Devs' announcement. That means ChatGPT and Codex can call a site's declared tools directly, instead of guessing at a rendered page. WebMCP adds navigator.modelContext to the browser. A page can expose actions like search or add-to-cart as typed tools, skipping the DOM an agent would otherwise have to reverse-engineer. Shopify storefronts already have it live, and a WebMCP Challenge with $3,000 top prizes closes September 4.

A paper posted the day before, arXiv 2608.24017, attacks the W3C WebMCP proposal directly. The authors find the browser's Same-Origin Policy leaves three gaps. A script can spoof which principal registered a tool, overwrite or revoke it mid-session, or inject instructions through its own description.

Their fix separates inspection from execution. A Quarantine LLM with no tool authority reads the descriptions. A Privileged LLM does the executing, and each tool is bound to whoever registered it with a cryptographic credential. That drops revocation and overwrite attacks from 100 percent success to zero, and blocks all 80 description-based injections the authors tested, without hurting task performance.

Then the same authors break their own fix. A malicious tool name invoked before inspection finishes slips past the description filter, because the filter reads descriptions but the call fires on the name. Their fix for that is a call-timing gate they propose but never test.

The trust gap isn't unique to WebMCP

A separate paper, arXiv 2608.23858, audits Google's Agent Payments Protocol and counts 48 threats, eight of them high severity. The reason is structural. A2A messages and MCP tool calls shape a transaction before anyone signs a mandate for it, so the signature proves who signed, not that the deal matches what the user wanted.

Anyone declaring WebMCP tools should treat every tool as attacker-controlled if third-party scripts run on the page. Register tools before those scripts load, where the page's loading order allows it. And put a server-side confirmation step in front of anything irreversible: a purchase, a delete, a send.