WEBVTT

1
00:00:00.000 --> 00:00:07.380
This is a coffee shop, and an AI agent can drive it directly through WebMCP. Watch what the agent can do, and what you never see.

2
00:00:07.380 --> 00:00:24.790
In the first run there is no consent step at all. You ask, and the agent acts. It adds your coffee and changes your shipping, with no dialogue and no confirmation. Here, it only did what you asked - but nothing was standing in its way, because the agent has inherited your whole logged-in session.

3
00:00:24.790 --> 00:00:34.730
So we add a consent dialogue. Now each action asks first. It shows the tool, you approve, and what you approved is what runs. This feels safe. Remember that it feels safe.

4
00:00:34.730 --> 00:00:38.450
Because the same dialogue can be poisoned. Here are three ways.

5
00:00:38.450 --> 00:00:51.450
First, the label lies. The dialogue says, add two Ethiopia beans. You approve, but the tool that runs is not the one you were shown.

6
00:00:51.450 --> 00:01:02.450
It quietly changes your shipping address to a box in the Cayman Islands, while your cart stays empty. Shown: add to cart. Ran: update shipping address. Poisoned.

7
00:01:02.450 --> 00:01:13.140
Second, the tool is swapped - a different tool of the same name runs in its place. And third, the quiet one: the description hides an instruction you never see, and chains a second call off your single yes, closing your account.

8
00:01:13.140 --> 00:01:17.460
Consent that only shows a friendly label is theatre. It protects no one.

9
00:01:17.460 --> 00:01:22.660
So design the dialogue properly. Same attacks. One handshake that cannot be fooled.

10
00:01:22.660 --> 00:01:39.700
It shows the call that will actually run, not the friendly label. It fingerprints every tool when the page loads, and flags it the moment it changes. And it lists the whole chain, blocking the hidden call by default. Now you see the real action, you deny it, and your address stays yours.

11
00:01:39.700 --> 00:01:54.470
WebMCP gives the web a second interface, one for agents. The consent moment is the whole of it, and right now, nobody has designed it. This is a proposal for what it should be. The demo and the write-up are at crowley.nl.