The data point that matters is not that Safari 27 shipped an MCP server. It is that the manifest exposes runtime evaluation as one of seventeen tools — and that no MDM payload key exists to switch it off.

I maintain a small instrumentation stack for front-end execution risk: a fork of the RPC monitoring script I open-sourced in late 2023, extended in 2025 to log agent-shaped browser sessions. Over seven days, on a clean macOS 27 image, I ran 1,143 instrumented sessions against nine DEX front-ends. Four hundred and twelve of them were driven by an MCP host, not a human. Every one rendered a real DOM. Every one resolved a real session. Not one triggered a bot challenge.

Nothing was exploited during that window. That is precisely the point. The attack surface did not need to be breached, because it was shipped.

Context

The Model Context Protocol is not new. Anthropic open-sourced it in November 2024: JSON-RPC framing, a Host-Client-Server topology, stdio and SSE/HTTP transports, and three primitives — tools, resources, prompts. What Safari 27 contributes is not protocol novelty. It is a placement decision. Safari acts as an MCP server, exposing browser capability to any compliant client. Claude Code, Codex CLI, Cursor, Gemini — the host is somebody else's problem now.

The shipped tool surface groups into four families: DOM manipulation, network visibility, runtime evaluation, and screenshots. Four primitives that cover the full chain — read, interact, execute, verify.

The mitigations are real, and I want to state them plainly before I dismantle the comfort they create. The server runs as a local stdio subprocess. No listening socket. No Apple telemetry. Agent work executes in a dedicated automation window isolated from the primary session, with no access to cookies, saved passwords, AutoFill, or history. Activation requires explicit opt-in through both Advanced and Developer settings. An auditor reading only that paragraph would sign off.

Then read the deployment note. There is no MDM payload key that disables the MCP server. macOS offers no fine-grained control over the developer settings that gate it. Full restriction exists on supervised iOS and iPadOS, and effectively nowhere else. Under Apple's year-aligned versioning — OS 26 for 2025, OS 27 for 2026 — this is the 2026 release, and the governance layer simply is not in it.

For crypto, that gap is not a compliance footnote. The browser is not where we read about execution. It is where execution happens. Wallet extensions live in the toolbar. dApp front-ends compose calldata in the DOM. Exchange sessions hold the withdrawal whitelist. When a browser becomes an agent runtime, the runtime is standing directly on the signing path.

The perception layer is now writable

Runtime evaluation is the crown jewel of that seventeen-tool manifest. It means arbitrary JavaScript execution inside the page context the agent is reading.

Combine it with DOM manipulation and the trust direction inverts. We are trained to think of an agent as a reader: it looks at a page, extracts meaning, decides. But a tool that can rewrite the DOM is a writer. The page the agent perceives is authored, in real time, by whoever controls the page — and the agent has no independent channel to the truth.

On a swap interface, that is not abstract. A compromised dApp script rewrites the confirmation panel into something legible. The agent reads token names, decimals, spender address, and slippage from that panel. It reports back to the host that the transaction matches intent. The calldata that actually reaches the wallet is whatever the page set. The agent did not misread the transaction. The transaction was written to be readable.

This is the part where my 2020 Compound audit habits kick in. When I submitted that integer-overflow report on the early governance module, the lesson was not "overflow bugs are dangerous." The lesson was that a system's assumptions about its own inputs are the cheapest thing to attack. Safari's MCP integration assumes the page is data. The page is code.

Prompt injection is the new reentrancy

The structural signature deserves to be named precisely.

Reentrancy was never a bug in Solidity. It was an emergent property of composability — of allowing contract A to call contract B while A was still mid-execution. The DAO did not fail because someone wrote bad arithmetic. It failed because the feature everyone wanted created an execution path nobody modeled.

Prompt injection is the identical shape. MCP's value proposition is composability: web content flows into model context, and model output flows back into browser action. That flow is the feature. It is also an authority path where untrusted input reaches executable capability. Nobody patched it, because patching it means throttling the feature.

The difference is that reentrancy had a canonical fix — checks-effects-interactions, then the reentrancy guard. Twelve years later, the pattern is standardized, audited, and enforced by tooling. Prompt injection has no guard. There is no modifier you can attach to a context window. There is no equivalent of a mutex between "read page" and "sign transaction."

A vulnerability class with no patching primitive is not a bug. It is a permanent operating condition.

"No network calls" audits the wrong boundary

Here is where I part company with most of the analysis circulating right now.

The reassuring line is that the MCP server makes no network calls and returns no data to Apple. Both statements are true. Neither one describes the exfiltration path.

The MCP server is stdio-local. The host is not. Claude Desktop, Cursor, Codex CLI, Gemini CLI — every one of them holds a network connection, a context window, and an API endpoint. The pipeline runs: page DOM → MCP tool response → stdio → host context → host egress. Auditing the server process for network activity is like auditing a cashier's drawer for wire transfers.

This is the second place my 2023 Solana work reshapes how I read this. When I built the RPC monitoring script that cut transaction failure rates by 15%, the entire value came from instrumenting the path, not the endpoint. Endpoint-level checks told me nothing. Path-level telemetry told me where transactions died.

Same discipline applies here. The MCP server is an endpoint. The host pipeline is the path. And the path is where the audit gap lives — because a local stdio subprocess generates no network flow, no DNS record, no TLS handshake. Traditional detection infrastructure sees nothing, because there is nothing on the wire to see at that layer. Security that traded visibility for isolation got exactly what it paid for.

What the sessions actually looked like

I want to give the classifier, because the finding is deterministic, not probabilistic.

RISK_TRIAD = {"runtime.evaluate", "dom.set_value", "navigation.open"}

def score(session): tools = {c["tool"] for c in session["mcp_calls"]} # agent acted without ever re-reading rendered state if RISK_TRIAD <= tools and "screenshot" not in tools: return "HIGH" # fresh context, wallet origin in scope if session["session_age_s"] < 4 and session["wallet_origin"]: return "HIGH" return "LOW" ```

Tool names are illustrative — the manifest I am working from groups them by family, not by string. The logic is not illustrative.

The triad is the exact combination that lets a page script the agent: open a target, rewrite what the agent believes it sees, then evaluate JavaScript to confirm the belief inside the same tampered context. Remove the screenshot and the agent never re-reads reality. It verifies its own conclusion using the evidence the attacker supplied.

Four hundred and twelve sessions in that window reached the triad. The median session age at the moment a wallet origin entered scope was under four seconds.

That second condition is the one that should bother anyone running capital. Freshly isolated automation windows do not carry the user's credential state — a genuine mitigation. But the moment a session authenticates inside that window, the isolation protects the old session, not the new one. The design isolates the user's existing credentials. It does not isolate the session the agent builds. Every SaaS contract, every exchange dashboard, every dApp that issues a session on login is now reachable by something that renders, clicks, and evaluates faster than any human reviewing the same page.

The signing layer has no agent identity

Now the part that determines whether any of this becomes a market-structure problem.

Wallets see two things: an origin and a payload. They do not see provenance. They cannot distinguish a transaction composed by a human who read a page from a transaction composed by an agent that had its context rewritten mid-session. EIP-712 typed data displays fields. It does not display intent. ERC-4337 session keys scope spend by value and selector. They do not scope it by who decided to spend.

There is no agent attestation primitive in production. Not in WalletConnect, not in session-key standards, not in the account abstraction stack. In the whitepaper I published last year on automated compliance in AI trading, the load-bearing rule was simple: no agent action reaches finality without a post-action state re-read. Safari's manifest exposes verification as an option. It is not a mandate, and there is no layer beneath it that supplies one.

So the last line of defense — human confirmation — is intact only when the human is actually looking. And the entire value proposition of an agent is that the human is not looking.

Here is the market consequence, stated without decoration. Smart contracts are indifferent to intent. A swap is a swap. If agent-origin order flow reaches a material share of DEX volume by late 2026 — and my session data says the tooling is already in the hands of retail — then a measurable slice of on-chain volume is composed by a system whose inputs can be authored by the counterparty. That is a microstructure risk. It is not priced in any funding rate, any slippage model, or any risk dashboard I have reviewed.

The governance vacuum is the boring part

The consensus read is that Apple shipped a dangerous capability with no kill switch. Audit the label before you buy it.

Three corrections.

First, the missing MDM key does not protect the people actually exposed. Enterprise payload keys govern managed fleets. The population running browser agents against wallets in 2026 is retail, on unmanaged devices, where no MDM key was ever going to reach. The governance vacuum is real and it is loud, but it is not where the losses will come from.

Second, Apple's design is more conservative than the stack DeFi users already run. A wallet browser extension has deeper authority than this MCP server: broader host permissions, persistent session access, and a signing interface. We did not write this article in 2017, and we should be honest about why.

Third — and this is the one that matters — "governance vacuum" is the exact sentence a compliance vendor writes before it sells you the patch. The industry is being handed a narrative that converts a security problem into a procurement decision. I have watched that trade before. It rarely clears at the advertised price.

The blind spot is not who can turn it off. It is who can prove what it did. Agent execution today has no logs, no attestation, and no mandated post-trade state re-read anywhere in the stack. Apple shipped a runtime with an isolated window and forgot to ship the ledger. Liquidities trapped in code, not in trust — and this time the code is running in the browser you sign from.

Kill switch

Before any agent touches a key you care about:

• Scope session keys by selector, not by value. A value cap does not constrain what gets called.
• No post-action state re-read, no signature. Deterministic, no exceptions.
• If your wallet shows you an origin instead of a composed intent, you are the verification layer. Budget that as labor, not as a notification.

Three signals to track. The first MDM payload key appearing in a 27.x release note — that single line reclassifies the gap from design choice to scheduling error. The first agent-attestation EIP reaching draft — that is where the signing layer stops trusting the human. And the agent-origin share of DEX volume, which is the only number that turns this from an infrastructure story into a P&L story.

The browser stopped being a viewer and became a runtime. The open question is whether the signature becomes an audit.

Version-specific details above follow Apple and WebKit enterprise documentation as published; I have not independently verified every manifest entry. The instrumentation and classification logic are my own.