Sierra released a draft protocol for personal agents called Poppy and announced 35 new design partners, including OpenAI, PayPal, Visa, Mastercard, Cloudflare, Notion, and 1Password. These companies will participate in the draft design process and provide feedback. Poppy builds on existing standards such as OAuth, JWT, HTTPS, OpenAPI, and MCP, and defines five components: discovery, session, login, cross-channel single session, and task execution.
NVIDIA 技术博客：可信 AI 与网络安全NVIDIA 技术博客：可信 AI 与网络安全 · Attention4040
Meta 在 Ray-Ban Display 的 WebMCP 开发文档中说明，Web App 可通过 document.modelContext.registerTool() 把页面动作注册为工具，供眼镜上的 Meta AI 在用户语音请求时调用；工具仅在 Web App 前台时可用，页面加载时注册、用户离开时注销，Meta AI 无法后台调用，单次调用超时为 10 秒，且每个工具动作须保留手动操作路径。文档同时指出，用于标记不可信文本的 untrustedContentHint 并非强制安全边界，不应依赖；开发者须把 Meta AI 传入的参数视为不可信并在 execute 中校验，不应仅因工具被调用就执行破坏性或不可逆操作，也不应接受模型对执行结果的描述，而应由页面自行验证和评分。
Anthropic launches long-term initiative Anthropic Cyber Mission, focusing on two directions: critical infrastructure and open-source software. The Critical Infrastructure Defense Program (CIDP) provides frontier Claude models, resident engineers, and threat research to operational technology defenders in electricity, water, transportation, and other sectors, with partners including CrowdStrike, Dragos, Palo Alto Networks, Rockwell Automation, and others. The simultaneously launched OSS Scanner is an opt-in vulnerability scanning service for the open-source ecosystem, using the company's strongest model to periodically scan participating projects for free; reports are entirely model-generated, without human review or triage, and therefore may be inaccurate. Anthropic says that over the past six months it scanned important software projects with its latest model, finding more than 29,000 candidate vulnerabilities, manually reviewing only about 6,000, and sending nearly 5,000 unverified reports directly to maintainers upon request.
Researchers released an open-source email prompt injection test set for testing whether email security gateways and AI email assistants can identify indirect prompt injection instructions in emails. The test set is designed with Microsoft Defender for Office 365's prompt injection protection in mind; samples are standard .eml emails and can also be used with other secure email gateways, Copilot, Gemini, and custom RAG pipelines. It covers three intent categories—system prompt leakage, data exfiltration via URLs, and probing of tools and write permissions—and four delivery encodings: plaintext visible, hidden HTML, Base64, and zero-width characters. Testers tested the new email prompt injection protection in Defender for Office 365 Plan 2 and found that emails with Base64 and zero-width character encoding bypassed mail flow filtering, but Copilot decoded and refused to answer at runtime; delivery does not equal compromise. The protection focuses on three intent categories: data exfiltration, extracting system prompts, and probing tools and write permissions. High-confidence emails are directly quarantined and classified as High Confidence Phish, with the new Detection Technology value set to Prompt Injection.
SierraSierra · 
