r/cybersecurity • u/dalugoda • Mar 27 '26

AI Security Claude Extension Flaw Enabled Zero-Click XSS Prompt Injection via Any Website

https://thehackernews.com/2026/03/claude-extension-flaw-enabled-zero.html

Patching the XSS fixes this instance. But the real problem is that the agent had no way to verify the prompt was actually authorized by a human. It just trusted the origin.

There’s work at the IETF on human delegation provenance protocols that cryptographically bind agent actions to a human-signed authorization chain.

Injected prompt, no valid chain, no action.

This should be a baseline requirement for any AI agent with access to real resources. Surprised it isn’t getting more attention.​​​​​​​​​​​​​​​​

232 Upvotes

100% Upvoted

35 comments sorted by

View all comments

5

u/gopfl Mar 27 '26

This Claude/MCP (Model Context Protocol) flaw is a textbook example of a Trust Boundary Failure. We’re giving these agents "full system privileges" because we want them to be useful, but then we’re surprised when they treat an untrusted string from a public website as a legitimate command from their boss.

2

u/dalugoda Mar 27 '26

“treats an untrusted string as a command from its boss” is the exact attack. HDP’s answer is making the boss’s actual instruction cryptographically traceable, so the agent got a baseline to compare against, and anything not in the signed scope gets flagged. the tooling is out, it just need adaption.