Agents Acting Safely on Our Behalf
Summary
The future of the web requires changing the web for agents, rather than solely relying on making agents smarter. The core technical solution discussed is WebMCP (Web Manifest Content Protocol), an API that allows site builders to define specific, deterministic actions for agents. This approach enhances security by allowing developers to annotate content (e.g., marking user-generated content as `readon`) and implementing consequential hints, ensuring agents do not operate non-deterministically by merely scraping the DOM or accessibility tree. Security requires multi-layer defenses, including agent containment, origin sets, and spotlighting.
Key takeaways
-
WebMCP is the preferred path for agent integration.
2:03
While agents are changing the web, the consensus is that the web must adapt. WebMCP offers an elegant API to specify exact agent actions, complementing existing protocols like REST and GraphQL, rather than replacing them. It allows for chained actions (e.g., `webmc` -> `mcp` -> `webmc`).
-
Agent experiences must be tailored and secure.
5:35
The ideal web experience is not limited to a single modality (e.g., pure agent use or pure human interaction). Developers must design for varying user appetites for agents, ensuring security and privacy through multi-layer strategies.
-
Security requires multi-layer defensive strategies.
5:35
To protect against non-deterministic agent behavior, recommended strategies include: **Special agent containment** (limiting scope, e.g., only five sites, or a $20 spending limit); **Origin sets** (restricting data sources to specific domains); and **Spotlighting** (giving greater weight to user-defined critical context within a large context window).
-
Strategic engineering requires 'thought experiments'.
22:14
To identify high-impact business problems, senior engineers should use thought experiments (like 'premortems') and apply deep empathy for users and site builders (e.g., considering HIPAA or attorney-client privilege requirements) to guide technical development.
Technical details
-
WebMCP Protocol
123s
WebMCP provides a deterministic surface area for agents, allowing developers to specify exact actions. It supports annotations (e.g., `readon` for user-generated content) to help agents distinguish between trustworthy and ephemeral web data, mitigating risks like prompt injection attacks.
-
Agent Modalities
335s
Agents can operate in various modes: **Computer-use apps** (headless, set-it-and-forget-it); **Browser-use agents**; **Co-browsing** (human-in-the-loop); and **Task-specific involvement** (where the user is intrinsically part of the process).
-
Security Mechanisms
335s
Defensive strategies include: **Agent Containment** (defining strict boundaries for agent access); **Origin Sets** (limiting data sources to specific domains); and **Spotlighting** (elevating the importance of user-defined context within LLM context windows).
-
Development Workflow
WebMCP is designed to be additive, complementing existing APIs like REST and GraphQL. The goal is to enable developers to opt-in easily, potentially through tooling that analyzes the DOM, though WebMCP remains the ideal long-term solution.
Mentioned resources
- MLOps Community
- Sarah Drasner
Channel & topics
Watch on YouTube · Back to latest
This independent, AI-assisted summary is provided for commentary and informational purposes. It may contain errors or omit important context. Please watch the original video for the creator's complete presentation. Video, thumbnail, and related copyrights belong to their respective owners.