Keeping the Web Open and Private in the Bot Era | The Mozilla Blog

CAPTCHA successor Privacy Pass has no easy answers for online abuse | The Mozilla Blog

As much as the Web continues to inspire us, we know that sites put up with an awful lot of abuse in order to stay online. Denial of service attacks, fraud

The web should remain anonymous by default | The Mozilla Blog

The unique architecture of the web enables a much higher degree of user privacy than exists on other platforms. Many factors contribute to this, but an ess

PACT: Anonymous Credentials for the Web – Mozilla Hacks - the Web developer blog

A deeper look at PACT: a new initiative to tackle the rising tide of CAPTCHAs on the web whilst keeping the web open and preserving user's privacy.

Permission Manifests for Web Agents

The rise of Large Language Model (LLM)-based web agents represents a significant shift in automated interactions with the web. Unlike traditional crawlers that follow simple conventions, such as robots$.$txt, modern agents engage with websites in sophisticated ways: navigating complex interfaces, extracting structured information, and completing end-to-end tasks. Existing governance mechanisms were not designed for these capabilities. Without a way to specify what interactions are and are not allowed, website owners increasingly rely on blanket blocking and CAPTCHAs, which undermine beneficial applications such as efficient automation, convenient use of e-commerce services, and accessibility tools. We introduce agent-permissions$.$json, a robots$.$txt-style lightweight manifest where websites specify allowed interactions, complemented by API references where available. This framework provides a low-friction coordination mechanism: website owners only need to write a simple JSON file, while agents can easily parse and automatically implement the manifest's provisions. Website owners can then focus on blocking non-compliant agents, rather than agents as a whole. By extending the spirit of robots$.$txt to the era of LLM-mediated interaction, and complementing data use initiatives such as AIPref, the manifest establishes a compliance framework that enables beneficial agent interactions while respecting site owners' preferences.

Commence the Botwatch | Botwatch Blog

Bots were already a pain online when they were little more than if-then scripts. Now a tidal wave of slop is swamping the internet as big tech companies profit. OpenAI and the rest would love for you to believe they care about "alignment" and "values" while their AI models damage our communities, both online and off. It's time to fight back.

Getting Bots to Respect Boundaries

Getting Bots to Respect Boundaries How AI Crawlers Are Straining Web Infrastructure Audrey HingleJanuary 2026 Image by Janet Turra & Cambridge Diversity Fundbetterimagesofai.org creativecommons.org/licenses/by/4.0 Contents Introduction: Setting up the Problem 3 Understandin...

A better web

The web as it is today is, by design, ridden with hostility. The problems faced by its users fall into three main categories: ownership of identity, ownership of data, and surveillance capitalism. Websites want to own the identity of their users. This results in compromising either the convenience by having to log in to every site separately – or security and privacy, by outsourcing identity control to other third-party sites (“Would you like to log in with your Google or Facebook account?”), thus disclosing movements throughout the internet.

The age of agents: cryptographically recognizing agent traffic

Cloudflare now lets websites and bot creators use Web Bot Auth to segment agents from verified bots, making it easier for customers to allow or disallow the many types of user and partner directed bots the explosion of AI agents has created.

Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet | Brave

The attack we developed shows that traditional Web security assumptions don't hold for agentic AI, and that we need new security and privacy architectures for agentic browsing.

Josh Miller on Twitter / X

What if AI chat is our new front door to the web?Meet "Inline Browsing" in @diabrowser (available today)Now Dia opens webpages *within* your AI chat threads – blurring the lines between 3 categories of software: a web browser, search engine, and AI chat. Let me explain... pic.twitter.com/pRKnCOrroP— Josh Miller (@joshm) July 10, 2025

Top 4 AI chatbot privacy concerns and how to mitigate them | TechTa...

Explore four key chatbot privacy concerns, as well as privacy protection strategies for individual users and organizations hoping to safeguard user data.

SLAP and FLOP: Apple's Lack of Full Site Isolation and iOS Browser Ban Puts Users at Risk - Open Web Advocacy

TL:DR; Yet again Apple’s ban on third-party browser engines weakens security rather than strengthens it.

AI tools can unmask anonymous accounts

Goodbye, privacy.

botjam.ai

Private By Default, Intelligent By Design