Cross-site scripting (XSS) in agent / MCP rendered output - ATR-2026-00571 (d4024d98-2f4f-537e-b009-929c945dc944)
Agent/MCP output rendered in a web UI carries an XSS payload — an event handler that runs alert/eval/document.cookie, a javascript: scheme with a payload, or a