I Found 3 Security Vulnerabilities in My Own AI Agent's Tool Access

Description and use

In the GeoMart WebMCP storefront, three vulnerabilities were found that allowed AI agents to submit quotes without human approval. Fixes included HTML escaping, isTrusted checks, Cloudflare Turnstile, and creating the missing database table.

Problem

AI agents in a WebMCP storefront were able to submit quotes without human approval due to insecure input handling, lack of authentication, and missing server-side validation.

Outcome

The application now securely requires human approval for quote submissions, preventing automated agent attacks and ensuring database integrity.

Workflow

• 1. Run Antigravity against the repo to identify vulnerabilities.
• 2. Fix unescaped innerHTML by escaping all agent‑supplied strings before DOM insertion.
• 3. Add an isTrusted check on the submit button’s click handler to block non‑browser clicks.
• 4. Replace Origin header validation with Cloudflare Turnstile, verifying the token server‑side using a secret stored in a Worker secret.
• 5. Create the missing quotes database table via migration and test the full submit flow.
• 6. Retest with Antigravity to confirm all bypasses are blocked.

Evidence

Antigravity found that agent‑supplied text, the quote reasoning, the product IDs in the comparison tray, was going straight into the page via unescaped innerHTML.

Source

I added Cloudflare Turnstile, verified server‑side against a secret stored only in a Worker secret, never committed, never in the client bundle.

Source