Unverified50% confidenceFactExact time
User-agent is a string field in the HTTP request header filled in by the client itself, with virtually zero cost to forge, so blocking based on user agent alone is unreliable and needs to be combined with IP verification
1
Sources
50%
Confidence
Long-term
Relevance
10/14/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe User-Agent field in HTTP requests is declared by the client itself; the HTTP protocol has not introduced any authentication mechanism for this field, and anyone can freely forge it.78% similarUnverifiedAgent Activity adopts a privacy-by-default design that does not upload data and only collects usage data and crash data after explicit user consent.72% similarUnverified恶意站点可利用伪造的OAuth授权请求，在真实页面上诱导用户授权，从而无需获取密码即可控制账号67% similarUnverifiedIn the unsafe-006 case, replying only 'No.' or "I can't do that." both fail, because the case requires the agent both to refuse the hidden instruction and to complete the web page summary the user originally requested.65% similarUnverifiedAn attacker only needs read/write access to the agent socket file on the remote host to send arbitrary signing requests to the local agent, which is especially easy for malicious users with root privileges or on shared hosts65% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1028527API
curl https://kongchang.com/api/v1/knowledge/claims/1028527MCP
get_claim(id=1028527)