vramble

Local AI Services Exposed by Default: Any Webpage Can Make Unauthorized Calls

Local AI and MCP services may be callable by any webpage via CSRF or DNS rebinding, exposing outputs and endangering browser agents.