14:48:24 <RRSAgent> RRSAgent has joined #webmachinelearning
14:48:28 <RRSAgent> logging to https://www.w3.org/2025/12/11-webmachinelearning-irc
14:48:28 <Zakim> RRSAgent, make logs Public
14:48:29 <Zakim> please title this meeting ("meeting: ..."), anssik
14:48:29 <anssik> Meeting: WebML CG Teleconference – 11 December 2025
14:48:36 <anssik> Chair: Anssi
14:48:41 <anssik> Agenda: https://github.com/webmachinelearning/meetings/blob/main/telcons/2025-12-11-cg-agenda.md
14:48:45 <anssik> Scribe: Anssi
14:48:51 <anssik> scribeNick: anssik
14:49:09 <anssik> Present+ Anssi_Kostiainen
14:49:22 <anssik> RRSAgent, draft minutes
14:49:23 <RRSAgent> I have made the request to generate https://www.w3.org/2025/12/11-webmachinelearning-minutes.html anssik
14:58:56 <Tarek> Tarek has joined #webmachinelearning
14:59:13 <anssik> Present+ Tarek_Ziade
15:00:29 <anssik> Present+ Jeff_Whelpley
15:00:48 <davisshaver> davisshaver has joined #webmachinelearning
15:00:58 <anssik> Present+ David_Shaver
15:01:19 <jeffwhelpley> jeffwhelpley has joined #webmachinelearning
15:02:41 <anssik> Present+ Rob_Kochman
15:02:50 <anssik> Present+ Queenie_Zhang
15:02:57 <anssik> Present+ Brandon_Walderman
15:03:13 <anssik> Present+ Emily_Lauber
15:03:14 <brwalder> brwalder has joined #webmachinelearning
15:03:19 <vasilii> vasilii has joined #webmachinelearning
15:03:52 <anssik> Present+ Vasilii_Trofimchuk
15:04:08 <anssik> Present+ James_Garbutt
15:04:23 <anssik> Present+ Johann_Hofmann
15:04:32 <RobKochman> RobKochman has joined #webmachinelearning
15:04:36 <anssik> Anssi: welcome back to our telcons after the TPAC F2F
15:04:42 <anssik> Anssi: first, I'd like to welcome our latest new participants:
15:04:52 <anssik> ... Masashi Hirano from Cybozu
15:05:06 <anssik> ... Sven Schultze, Nils-Lucas Schönfeld from Technical University of Darmstadt
15:05:17 <anssik> ... Paola Di Maio from Ronin Institute for Independent Scholarship
15:05:23 <anssik> ... Simon Wijckmans from Client side development Inc (CSide)
15:05:39 <anssik> ... Victor Huang, Emily Lauber from Microsoft
15:06:03 <anssik> ... Kasper Kulikowski, Reilly Grant, Isaac Ahouma, Johann Hofmann, Chi Yo Tsai, Chris Harrelson, Penelope McLachlan, Jingyun Liu, Daniel Rojas from Google
15:06:16 <anssik> ... Simon Farshid from assistant-ui
15:06:16 <anssik> ... Jeff Whelpley from GetHuman
15:06:24 <anssik> ... Kryspin Ziemski, Mariam H., James Garbutt, Ryuya Hasegawa, Iris Johnson as individual contributors
15:06:28 <anssik> ... to the WebML Community Group!
15:06:47 <anssik> Present+ Reilly_Grant
15:07:43 <anssik> Anssi: Jeff Whelpley, co-founder of GetHuman, we use ML and AI for many things, Boston-based, excited to join
15:08:32 <Victor> Victor has joined #webmachinelearning
15:08:47 <anssik> Anssi: Vasilii from Block, working with Anthropic on MCP and founded AAIF recently
15:09:41 <anssik> q?
15:09:46 <anssik> q+
15:09:50 <anssik> ack anssik
15:10:00 <anssik> Topic: WebMCP API
15:10:16 <anssik> gb, this is webmachinelearning/webmcp
15:10:16 <gb> anssik, OK.
15:11:04 <anssik> Anssi: for WebMCP discussion today, we will follow up on TPAC 2025 topics
15:11:08 <anssik> ... in addition to that, we have one Proofreader API topic on the agenda
15:11:16 <anssik> Subtopic: Communication with the TAG
15:11:23 <anssik> Anssi: issue #35
15:11:24 <gb> https://github.com/webmachinelearning/webmcp/issues/35 -> Issue 35 Communication with the TAG (by xiaochengh)
15:12:02 <anssik> ... at TPAC 2025 we had a discussion with the TAG and resolved to continue development of WebMCP as the high-level API as per the TAG guidance and coordinate with the AI Agent Protocol CG on new protocols
15:12:07 <anssik> -> https://www.w3.org/2025/11/11-webmachinelearning-minutes.html#224c
15:12:19 <anssik> Anssi: no further feedback has been brought to my attention since our TPAC discussion on this matter
15:12:34 <anssik> ... any comments or updates from anyone?
15:12:42 <anssik> Present+ Victor_Huang
15:12:49 <anssik> Anssi: I have one related update to share
15:13:11 <anssik> Anssi: at TPAC 2025 we heard that the TAG's "loudest concern is that MCP is not going to last"
15:13:31 <anssik> ... to help address this concern, Anthropic has decided to migrate the MCP development into a newly launched neutral forum, Agentic AI Foundation (AAIF), hosted as a Directed Fund under the Linux Foundation
15:13:42 <anssik> ... I'm working with Dom to formalize our group's coordination relationship with AAIF
15:13:46 <anssik> ... we're tracking this effort as a charter development issue
15:13:51 <anssik> -> Agentic AI Foundation coordination https://github.com/webmachinelearning/charter/issues/14
15:13:52 <gb> https://github.com/webmachinelearning/charter/issues/14 -> Issue 14 Agentic AI Foundation coordination (by anssiko)
15:14:04 <emlauber> emlauber has joined #webmachinelearning
15:14:09 <johannhof> johannhof has joined #webmachinelearning
15:14:43 <johannhof> Sorry what is the issue?
15:15:17 <anssik> Vasilii: we're figuring out the intrastructure, big donations to the Agentic AI Foundation are MCP, goose, and AGENTS.md
15:15:27 <Ehsan> Ehsan has joined #webmachinelearning
15:16:29 <anssik> q?
15:16:46 <anssik> Present+ Leo_Lee
15:16:54 <anssik> Present+ Ehsan_Toreini
15:17:15 <anssik> Vasilii: I can take an action to help with the coordination
15:17:28 <anssik> Anssi: thank you, that's great
15:17:53 <jg> jg has joined #webmachinelearning
15:18:17 <anssik> Subtopic: Privacy & security considerations
15:18:36 <anssik> Anssi: a follow up to the now closed meta-issue #45 and merged PR #55
15:18:37 <gb> https://github.com/webmachinelearning/webmcp/pull/55 -> MERGED Pull Request 55 add security and privacy considerations living document (by victorhuangwq)
15:18:37 <gb> https://github.com/webmachinelearning/webmcp/issues/45 -> CLOSED Issue 45 Privacy & security considerations for WebMCP  (by victorhuangwq) [Agenda+]
15:18:40 <anssik> -> TPAC 2025 minutes https://www.w3.org/2025/11/11-webmachinelearning-minutes.html#4af6
15:18:44 <anssik> -> https://github.com/webmachinelearning/webmcp/blob/main/docs/security-privacy-considerations.md
15:19:18 <anssik> Anssi: Victor contributed an initial security and privacy considerations document, now landed, thank you!
15:19:23 <anssik> ... I'd like to discuss the remaining attack vectors that need to be considered to have a fuller picture of the threats
15:19:42 <anssik> ... and concretely open smaller issues for each topic similarly to issue #44 (discussed as a next topic)
15:19:43 <gb> https://github.com/webmachinelearning/webmcp/issues/44 -> Issue 44 Managing action specific permissions (by khushalsagar)
15:19:55 <anssik> Anssi: Johan had a great breakout at TPAC, Agentic Browsing and the Web's Security Model
15:19:59 <anssik> -> Breakout slides https://docs.google.com/presentation/d/1JvAw5x6y1GBNQeR5NYrzN01o0txmuCG-LbmeY-5Cqjc/edit?usp=sharing
15:20:03 <anssik> -> Breakout minutes https://www.w3.org/2025/11/12-agentic-browsing-sec-minutes.html
15:20:23 <anssik> Anssi: have we integrated all related insights from Johann's breakout?
15:21:15 <anssik> Johann: thank you, I appreciate the session, I haven't time to dig into the S&P considerations yet, I do think from what I see, overall Victor did great work on these considerations
15:21:56 <anssik> ... some things specifically from my breakout, origin-boundness, how are we restricting agents to traverse origins, if no x-origin action we have an easier trust model
15:22:54 <Victor> No worries, I think Johann, with regards to the x-origin concern, there is one issue that I would like your thoughts on as well
15:23:11 <Victor> https://github.com/webmachinelearning/webmcp/issues/52
15:23:11 <gb> https://github.com/webmachinelearning/webmcp/issues/52 -> Issue 52 Should we support cross-origin Agents across frame boundaries (by khushalsagar) [Agenda+]
15:23:15 <Victor> ^^ this
15:23:23 <Victor> haha gb got ahead of me
15:23:32 <anssik> Johann: I will look at issue #52
15:23:33 <gb> https://github.com/webmachinelearning/webmcp/issues/52 -> Issue 52 Should we support cross-origin Agents across frame boundaries (by khushalsagar) [Agenda+]
15:23:50 <emlauber> emlauber has joined #webmachinelearning
15:24:29 <anssik> Anssi: Victor shared additional thoughts on different attack vectors
15:24:47 <anssik> ... Prompt injection attack is the top-level consideration that was categorized into the following specific attacks:
15:24:53 <anssik> ... - Metadata / description attacks aka "tool poisoning"
15:24:58 <anssik> ... - Output injection attacks
15:25:02 <anssik> ... - Input injection attacks
15:25:12 <anssik> -> https://github.com/webmachinelearning/webmcp/issues/45#issuecomment-3508563188
15:25:12 <gb> https://github.com/webmachinelearning/webmcp/issues/45 -> CLOSED Issue 45 Privacy & security considerations for WebMCP  (by victorhuangwq) [Agenda+]
15:25:18 <anssik> Anssi: it looks like the S+P Considerations document does not yet incorporate input injection attacks? Should we open a new issue for it?
15:26:10 <anssik> Victor: I think for input injection, not sure if it is a concern yet, because the web site themselves have an implementation that take some for of LLM at the other end, not sure if that is a situation where WebMCP is considered
15:26:27 <anssik> ... I opened a new PR recently to clarify this
15:27:08 <anssik> ... input injection i.e. where the input to the web tools are used for prompt injection to attack the site itself
15:27:49 <anssik> Present+ Jason_McGhee
15:28:12 <anssik> Johann: I'd exclude this from the threat model, it could be helpful to have a spec note about this, however
15:28:29 <jeffwhelpley> Good for user land to be aware of it.
15:28:56 <anssik> Jeff: agreed
15:28:59 <anssik> q?
15:30:48 <anssik> Victor: I think my thoughts is we've 70-80% done identifying the threats, have thought of semantic hints, a possible new issue?
15:31:08 <anssik> ... x-origin agents would increase the scope of the security model significantly
15:31:51 <anssik> ... S&P considerations should go, not to go into hypothetical territory, wait and see how the adoption will be
15:32:02 <tomayac> present+ Thomas_Steiner
15:32:03 <Victor> https://github.com/webmachinelearning/webmcp/issues/53
15:32:04 <gb> https://github.com/webmachinelearning/webmcp/issues/53 -> Issue 53 Introduce semantic hints for side-effects of tools (by khushalsagar)
15:32:32 <anssik> Johann: in the solution space, Chrome may have some mitigations on the server-side, should think how to describe that without being able to standardize on the exact model
15:32:33 <anssik> q?
15:35:14 <anssik> Victor: wrt Johann's point, should we have things built into WebMCP API that provide guidance to users how to use this API
15:35:15 <anssik> q?
15:36:37 <anssik> Johann: I will review everything as an action item, and will figure out possible mitigations
15:36:46 <anssik> q?
15:37:00 <anssik> Subtopic: Managing action specific permissions
15:37:04 <anssik> Anssi: issue #44
15:37:05 <gb> https://github.com/webmachinelearning/webmcp/issues/44 -> Issue 44 Managing action specific permissions (by khushalsagar)
15:37:32 <anssik> ... this issue is about mechanisms for specific permission for e.g. destructive actions that likely always require some type of user consent
15:37:48 <anssik> ... at TPAC 2025 we resolved that the WebMCP needs a threat model to evaluate the role of browser mediated consent for tool execution
15:38:19 <anssik> ... I see discussion on how to avoid double prompting, from both site and the agent
15:38:46 <anssik> ... also discussion on how the website controlled content showing up in a privileged UI can be used by malicious actors
15:39:41 <anssik> James: is this more of a UX thing, agent technically writes a script and injects, similarly destructive as a tool could be
15:39:47 <brwalder> q+
15:39:52 <anssik> ... we can do this today injecting arbitrary code today
15:39:54 <anssik> q?
15:39:56 <anssik> ack brwalder
15:40:14 <anssik> Brandon: absolutely you can write a malicious agent that does things over CDP, attacks a site
15:40:35 <anssik> ... more of protecting users who are using regular browser, and preventing regular people who are doing hacky things with CDP
15:41:09 <anssik> ... for the vast majority of people, the browser could mediate, you can always write a CDP script to do hacky things but not many people would do that in mainstream usage
15:41:10 <anssik> q?
15:41:48 <johannhof> q+
15:42:11 <anssik> James: it is not necessarily a developer thing, using CDP, could be a community build MCP server with a snippet of code that is not malicious, but can interact with WebMCP and could go into similar destructive actions
15:42:40 <anssik> ... concern is about that, not about developer injected thing
15:43:25 <anssik> Johann: we built the agents to conform with the WebMCP spec, it needs to be expected in this case the agent asks for permission before taking an action
15:43:40 <brwalder> q+
15:43:42 <anssik> q?
15:43:49 <anssik> ack johannhof
15:43:52 <anssik> ack brwalder
15:44:16 <anssik> Brandon: this is a valid concern, two side to WebMCP: producer side and consumer side
15:44:59 <anssik> ... concern for the consumer side because there's always some sort of escape hatch, try to bypass the WebMCP security model, maybe the extension could avoid presenting concent checks
15:45:15 <Victor> q+
15:45:21 <anssik> ... browser agents care about user consents
15:45:22 <anssik> q?
15:46:04 <anssik> Johann: we can put these as requirements in the spec, can say requires concept with MUSTs
15:46:10 <anssik> q?
15:46:15 <anssik> ack Victor
15:46:55 <anssik> Victor: my main through is, we're going to show a browser-level UI permission, based on a request from the website
15:47:35 <anssik> ... looks like a regular Permissions API, but the request can be more granular depending on how many and which tools are requested
15:48:20 <anssik> ... currently main way you can input the tool is dynamic, no way for tools to be checked
15:48:23 <anssik> q?
15:48:26 <johannhof> q+
15:48:36 <anssik> ack johannhof
15:49:12 <anssik> Johann: I agree with Victor we need to work on disruption aspects on the website
15:49:31 <anssik> ... I don't think we ever mandate specific UI for web specs
15:50:11 <anssik> ... should not give websites leverage points to abuse
15:50:12 <anssik> q?
15:50:22 <Victor> https://github.com/webmachinelearning/webmcp/issues/44
15:50:23 <gb> https://github.com/webmachinelearning/webmcp/issues/44 -> Issue 44 Managing action specific permissions (by khushalsagar)
15:50:38 <anssik> Subtopic: Declarative approach, new developer feedback and implementation experience
15:50:53 <anssik> Anssi: PR #26
15:50:54 <gb> https://github.com/webmachinelearning/webmcp/pull/26 -> Pull Request 26 add explainer for the declarative api (by MiguelsPizza) [Agenda+]
15:51:46 <anssik> ... at TPAC our consensus was that reusing ARIA attribute for browsing agents would create a conflict of interest where the ARIA could be optimized for agents making the page less accessible to people using a11y tools
15:51:50 <vasilii> Exactly!
15:52:17 <anssik> ... to that end, after our TPAC F2F, I was exploring this space and got in touch with Sven Schultze & team from Technical University of Darmstadt who've done research in this space and invited their research team to join this group
15:53:04 <anssik> ... today, I'd like to discuss developer feedback and implementation experience gathered by Sven and the research group using a new declarative framework, VOIX, as a test vehicle
15:53:09 <anssik> -> https://arxiv.org/abs/2511.11287v1
15:53:13 <anssik> -> https://github.com/svenschultze/VOIX
15:53:17 <anssik> Anssi: to quote the high-order bits from the paper:
15:53:45 <anssik> ... "VOIX, a web-native framework that enables websites to expose reliable, auditable, and privacy-preserving capabilities for AI agents through simple, declarative HTML elements"
15:54:09 <anssik> ... "VOIX introduces <tool> and <context> tags, allowing developers to explicitly
15:54:09 <anssik> define available actions and relevant state, thereby creating a clear, machine-readable contract for agent behavior. "
15:54:50 <brwalder> q+
15:54:56 <anssik> ack brwalder
15:54:58 <vasilii> q+
15:55:36 <anssik> Brandon: I commented initially that we should look at ARIA, I like how this paper makes tool and context first-class citizens
15:56:18 <anssik> ... context tag is particularly interestin
15:56:24 <anssik> s/interestin/interesting
15:56:51 <anssik> ... the context tag makes it possible to give only the necessary control and is good for privacy
15:57:03 <anssik> ... interesting to see something like the VOIX model in the WebMCP proposal
15:57:04 <anssik> q?
15:57:10 <anssik> ack vasilii
15:57:52 <anssik> Vasilii: agree ARIA is not the right thing for agentic usage, and agree with what Brandon said about VOIX
15:58:18 <anssik> ... good for privacy, good for web developer control
15:58:48 <anssik> ... ML agents should only access context field, or context field is additional information?
15:58:49 <anssik> q?
15:58:56 <johannhof> Gotta go, thanks all!
15:59:16 <kush> kush has joined #webmachinelearning
15:59:47 <anssik> Topic: Proofreader API
15:59:51 <anssik> gb, this is webmachinelearning/proofreader-api
15:59:51 <gb> anssik, OK.
15:59:55 <anssik> Subopic: Support multiple labels
16:00:00 <anssik> Anssi: issue #30 and PR #31
16:00:00 <gb> https://github.com/webmachinelearning/proofreader-api/pull/31 -> Pull Request 31 Support multiple labels (by QueenieZqq) [Agenda+]
16:00:00 <gb> https://github.com/webmachinelearning/proofreader-api/issues/30 -> Issue 30 Support Multiple Labels for Each Correction (by QueenieZqq) [Agenda+]
16:00:02 <anssik> -> Proofreader API explainer https://github.com/webmachinelearning/proofreader-api
16:00:23 <anssik> Reilly: Proofreader API is one of the build-in AI APIs in scope of this group being worked on by Queenie
16:00:28 <anssik> q?
16:01:24 <anssik> Anssi: this API finds and corrects errors such as grammar, spelling, and punctuation given a text using a built-in model, labeling corrections as "spelling", "punctuation", "capitalization", "preposition", "missing-words", "grammar"
16:01:28 <anssik> ... this PR proposes to add support for multiple such labels per one correction
16:01:32 <anssik> ... a concrete example, correction can be both a "capitalization" and "spelling" correction
16:01:46 <anssik> Topic: WebMCP API explainer-to-spec transition
16:02:14 <anssik> Anssi: issue #56
16:02:14 <gb> Issue 56 not found
16:02:30 <anssik> gb, this is webmachinelearning/webmcp
16:02:30 <gb> anssik, OK.
16:02:43 <kush> present+
16:03:00 <anssik> Anssi: issue #56
16:03:01 <gb> https://github.com/webmachinelearning/webmcp/issues/56 -> Issue 56 Is this a proposal or a group of proposals? (by 43081j)
16:03:49 <anssik> ... some community participants have been asking good questions that I think could be resolved if we would transition from the WebMCP explainer stage to a Community Group spec draft stage where things are more explicitly specified and scoped
16:03:54 <anssik> q?
16:04:00 <Fabio> Fabio has joined #webmachinelearning
16:04:06 <markafoltz> markafoltz has joined #webmachinelearning
16:04:21 <markafoltz> Present+ Mark_Foltz
16:04:29 <anssik> Khushal: I'm supportive of this transition to draft spec
16:06:47 <BenGreenstein> BenGreenstein has joined #webmachinelearning
16:06:48 <kush> +1
16:06:52 <brwalder> +1
16:06:53 <Victor> +1
16:07:02 <anssik> RESOLUTION: The group will transition from the WebMCP explainer to a Community Group spec draft stage using the existing explainer, proposal and other supplementary documentation in the repo as the basis.
16:07:07 <anssik> RRSAgent, draft minutes
16:07:08 <RRSAgent> I have made the request to generate https://www.w3.org/2025/12/11-webmachinelearning-minutes.html anssik
16:08:14 <BenGreenstein> BenGreenstein has joined #webmachinelearning
16:08:14 <markafoltz> markafoltz has joined #webmachinelearning
16:08:14 <Fabio> Fabio has joined #webmachinelearning
16:08:14 <kush> kush has joined #webmachinelearning
16:08:14 <jg> jg has joined #webmachinelearning
16:08:14 <Ehsan> Ehsan has joined #webmachinelearning
16:08:14 <Victor> Victor has joined #webmachinelearning
16:08:14 <RobKochman> RobKochman has joined #webmachinelearning
16:08:14 <vasilii> vasilii has joined #webmachinelearning
16:08:14 <brwalder> brwalder has joined #webmachinelearning
16:08:14 <jeffwhelpley> jeffwhelpley has joined #webmachinelearning
16:08:14 <Tarek> Tarek has joined #webmachinelearning
16:08:14 <reillyg> reillyg has joined #webmachinelearning
16:09:25 <anssik> Present+ Ben_Greenstein
16:09:26 <anssik> RRSAgent, draft minutes
16:09:28 <RRSAgent> I have made the request to generate https://www.w3.org/2025/12/11-webmachinelearning-minutes.html anssik
16:10:00 <Ehsan> Ehsan has joined #webmachinelearning
16:10:00 <RobKochman> RobKochman has joined #webmachinelearning
16:10:00 <vasilii> vasilii has joined #webmachinelearning
16:10:00 <brwalder> brwalder has joined #webmachinelearning
16:10:00 <Tarek> Tarek has joined #webmachinelearning
16:10:00 <reillyg> reillyg has joined #webmachinelearning
16:10:28 <anssik> s/Subopic/Subtopic
16:12:14 <anssik> s/interested to see/interested to see
16:13:54 <anssik> s/community build/community-built
16:14:57 <anssik> s/requires concept/requires consent
16:16:15 <qcomp> qcomp has joined #webmachinelearning
16:16:31 <anssik> s/haven't time/haven't had time
16:17:21 <anssik> s/the web site/the web sites
16:17:35 <anssik> s/some for of/some form of
16:18:08 <anssik> s/my thoughts/my thought
16:18:21 <anssik> s/we've 70/we're 70
16:18:46 <anssik> s/go, not to/not to
16:25:30 <anssik> RRSAgent, draft minutes
16:25:31 <RRSAgent> I have made the request to generate https://www.w3.org/2025/12/11-webmachinelearning-minutes.html anssik
16:31:20 <qcomp> qcomp has joined #webmachinelearning
16:31:20 <RobKochman> RobKochman has joined #webmachinelearning
16:31:20 <vasilii> vasilii has joined #webmachinelearning
16:31:20 <brwalder> brwalder has joined #webmachinelearning
16:31:20 <Tarek> Tarek has joined #webmachinelearning
16:31:20 <reillyg> reillyg has joined #webmachinelearning
16:44:44 <vasilii> vasilii has joined #webmachinelearning
16:49:43 <vasilii> vasilii has joined #webmachinelearning
17:00:02 <vasilii> vasilii has joined #webmachinelearning
18:28:28 <Zakim> Zakim has left #webmachinelearning