A new unofficial proposal draft from the W3C catalogs 27 distinct security threats in WebMCP, the browser API letting pages register callable tools for AI agents — before most sites have shipped it.
On November 9, 2026, the W3C published Threat Model for WebMCP, the first dedicated security analysis of WebMCP — the Web Machine Learning Community Group's draft API that lets a page register JavaScript functions as discoverable, callable tools for AI agents running in the browser. The document is an unofficial proposal draft, not yet a formal W3C Note, but its existence signals that the standards body sees WebMCP as risky enough to need a horizontal security review before it ships any further.
That timing matters more than it might look. Teams scoping how their site should talk to AI agents, whether through WebMCP's document.modelContext interface or a hand-rolled tool layer behind the same idea, are making an architecture decision with real exposure on both sides: what the agent can call, and what it can be tricked into calling. Getting that boundary right from the start is exactly the kind of problem a dedicated GenAI integration services team is built to scope before a single tool gets registered in production, rather than after a first incident forces a rewrite.
WebMCP, developed jointly by Google and Microsoft engineers inside the Web Machine Learning Community Group, gives a page a way to say "here are the actions an agent may take on my behalf" through a structured, typed interface rather than screen-scraping buttons and forms. The current specification, dated November 2, 2026, is a Draft Community Group Report: explicitly not on the W3C Standards Track yet, though Chrome has already shipped an origin trial. An October 8, 2026 spec revision dropped the declarative, HTML-annotation-based version of the API entirely, leaving registerTool() as the only path a page has for exposing callable functionality to an agent.
The document, authored with the W3C Security Interest Group and researchers from Fondazione Bruno Kessler, works through 27 named threats (T-01 through T-27) across three layers:
The W3C's own framing is blunt about scope: it starts from the spec itself and reasons from there, not from a hypothetical ideal API, which is why cross-origin exposure and the "two-sided opt-in" model get the most detailed treatment — they're the parts of the current design most likely to surprise a site that assumed tool registration was purely same-origin and purely declarative.
If you haven't registered a single WebMCP tool yet, this is good timing, not bad news: you get to design against a named threat list instead of discovering T-06 (cross-origin tool exposure) in production. Three things worth doing before any tool ships:
registerTool() call as a new, explicit trust boundary — document what the tool can do, not just what it's named;For teams without in-house capacity to run that review themselves, this is squarely the kind of scoping question a GenAI integration services engagement is meant to front-load, before a tool-calling surface reaches users, not after.
The threat model itself is an "Unofficial Proposal Draft" as of November 9, 2026 — it has not yet cleared the First Note request filed in the W3C transitions tracker, so expect revisions before it becomes a published W3C Note. WebMCP itself remains a Draft Community Group Report, not on the Standards Track, with Chrome running an origin trial and Edge expected to follow given the shared engine. None of this is final; both documents are explicitly living drafts, and the window the W3C's own WebMCP notes describe — meaningful community input before implementation momentum sets the design in stone — is still open right now.