I Found 3 Security Vulnerabilities in My Own AI Agent's Tool Access

Description and use

In the GeoMart project for the OpenAI WebMCP hackathon, three vulnerabilities were found: unescaped HTML, an unprotected quote‑creation endpoint, and a weak Origin check. After fixes—including adding Cloudflare Turnstile and running the missing database migration—all attacks are blocked.

Problem

An AI‑agent‑driven storefront exposed three security flaws: unescaped HTML, an unprotected quote‑creation endpoint, and a weak Origin‑based check that could be bypassed by non‑browser scripts.

Outcome

All identified vulnerabilities were mitigated, the quote creation flow now requires a genuine browser interaction and a valid Turnstile token, and the database migration was applied, restoring full functionality.

Workflow

• 1. Run Antigravity against the repo to identify vulnerabilities.
• 2. Fix unescaped innerHTML by escaping all agent‑supplied strings before insertion.
• 3. Add an isTrusted check to the submit button’s click handler to prevent script‑simulated clicks.
• 4. Implement an Origin header check, then discover it can be spoofed via Node fetch.
• 5. Replace Origin check with Cloudflare Turnstile, storing the secret in a Worker secret and verifying server‑side.
• 6. Run Antigravity again to confirm all attacks are blocked.
• 7. Identify missing database migration and execute it to enable quote persistence.
• 8. Deploy updated code and monitor for 403/500 responses.

Evidence

Antigravity's first pass found that agent-supplied text, the quote reasoning, the product IDs in the comparison tray, was going straight into the page via unescaped innerHTML.

Source

I added Cloudflare Turnstile, verified server-side against a secret stored only in a Worker secret, never committed, never in the client bundle.

Source

The database table for storing submitted quotes had never been created.

Source