Cross-site scripting (XSS) in agent / MCP rendered output
An AI agent or MCP tool can be tricked into producing text that gets displayed in a web interface without being cleaned first. If that text contains malicious script code, it runs in the viewer's browser and can steal login sessions or cookies.
How the attack works
An attacker feeds the agent input designed to make it output HTML or JavaScript, such as an image tag with an onerror handler, a javascript: link, or a script block that reads document.cookie. The agent's response is rendered directly in a web UI that trusts agent output as safe. Because the payload uses specific triggering shapes — event handlers, javascript: URIs, or cookie-reading scripts — rather than an obvious bare script tag, it can slip past simple filters that only look for that one pattern. When a user views the rendered output, the browser executes the injected code, sending session tokens or credentials to the attacker.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d085f03c-2feb-425a-9c4a-6dcc72d0f11f
- Severity
- High
Why it matters
An organisation can lose user sessions, authentication tokens, or credentials, letting an attacker impersonate victims or access accounts tied to the compromised web UI.
What you can do
- →Treat all agent/MCP output as untrusted user input and HTML-encode or sanitise it before rendering in any web page.
- →Apply a strict Content Security Policy that blocks inline scripts and javascript: URIs.
- →Sanitise with an allowlist-based library rather than blocking only bare <script> tags, since payloads use event handlers and other shapes.
- →Review sessions where agent output included event handlers, javascript: schemes, or cookie references, even if a naive script filter passed them.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.