Methodology
Auto-submit risk
ia.auto-submit-risk · 5.11
Act
MAY
Recommendation
Why it matters
The toolautosubmit attribute allows AI agents to submit forms without user confirmation. This is safe for search/filter forms but risky for payment, account deletion, or password forms.
How to fix it
Remove toolautosubmit from forms with sensitive data.
-
Find forms with toolautosubmit and a password, payment or delete action.
-
Remove toolautosubmit from these forms so that the user confirms each submit.
Verify
Run a new scan for this checkpoint:
isagentready results {domain} --checkpoint ia.auto-submit-risk
Details Mapping, lifecycle and references
- AR mapping
- No AR practice
- Evidence source
- WebMCP W3C Proposal
- Score role
- Informational
- Introduced
- 2026-08-24
- Methodology version
- 2026-10-22