I Found 3 Security Vulnerabilities in My Own AI Agent's Tool Access

Описание и применение

В проекте GeoMart, созданном для хакатона OpenAI WebMCP, обнаружены три уязвимости: неэкранированные HTML‑строки, незащищённый эндпоинт создания котировок и слабая проверка Origin. После исправлений, включая внедрение Cloudflare Turnstile и исправление миграции базы данных, все атаки блокируются.

Задача

An AI‑agent‑driven storefront exposed three security flaws: unescaped HTML, an unprotected quote‑creation endpoint, and a weak Origin‑based check that could be bypassed by non‑browser scripts.

Результат

All identified vulnerabilities were mitigated, the quote creation flow now requires a genuine browser interaction and a valid Turnstile token, and the database migration was applied, restoring full functionality.

Рабочий процесс

• 1. Run Antigravity against the repo to identify vulnerabilities.
• 2. Fix unescaped innerHTML by escaping all agent‑supplied strings before insertion.
• 3. Add an isTrusted check to the submit button’s click handler to prevent script‑simulated clicks.
• 4. Implement an Origin header check, then discover it can be spoofed via Node fetch.
• 5. Replace Origin check with Cloudflare Turnstile, storing the secret in a Worker secret and verifying server‑side.
• 6. Run Antigravity again to confirm all attacks are blocked.
• 7. Identify missing database migration and execute it to enable quote persistence.
• 8. Deploy updated code and monitor for 403/500 responses.

Доказательства

Antigravity's first pass found that agent-supplied text, the quote reasoning, the product IDs in the comparison tray, was going straight into the page via unescaped innerHTML.

Источник

I added Cloudflare Turnstile, verified server-side against a secret stored only in a Worker secret, never committed, never in the client bundle.

Источник

The database table for storing submitted quotes had never been created.

Источник