On "The WebMCP Tools You Expose To Agents Can Be Used To Hijack Them"

The security risk is real but Chrome's guidance on sandboxing and tool exposure is standard hardening, not a WebMCP problem—it's a "you exposed a powerful tool to an untrusted agent" problem. Every integration that hands AI systems access to meaningful APIs has this exact vulnerability surface; WebMCP just makes the attack path visible because the tool names are explicit. The practical takeaway: audit what you're actually letting agents call before you blame the protocol. Most teams aren't doing that yet.