Pinned Tweet
anon’s guide to actually supporting privacy:
> donate to tools you use instead of just complaining they need money
> contribute code if you can, documentation if you can’t
> use private money (cryptocurrency, cash)
> tell normies about alternatives without being insufferable about it
> work for companies that aren’t surveillance machines
> push for legal protections because tech alone won’t save us
privacy isn’t a product you buy, it’s an economy you build
> donate to tools you use instead of just complaining they need money
> contribute code if you can, documentation if you can’t
> use private money (cryptocurrency, cash)
> tell normies about alternatives without being insufferable about it
> work for companies that aren’t surveillance machines
> push for legal protections because tech alone won’t save us
privacy isn’t a product you buy, it’s an economy you build
20
39
288
66,795
I have been testing @TryMapleAI for a while now. The team is friendly and open to feedback, and their privacy architecture is directionally right. I see real potential in products like this, and I want open source and privacy to win. I only came across Maple recently, otherwise it would have been on the list a long time ago.
I have kept adding to the tools directory, and the goal remains the same: help you choose tools that fit your threat model and your everyday use.
Curated by me. No affiliate links, no sponsorships, no paid rankings.
profincognito.me/tools
I have kept adding to the tools directory, and the goal remains the same: help you choose tools that fit your threat model and your everyday use.
Curated by me. No affiliate links, no sponsorships, no paid rankings.
profincognito.me/tools
Awesome to see @iAnonymous3000 add @TryMapleAI to the site 🦾
4
4
18
640
Hey @fouadmatin @thsottiaux, I am a security and privacy researcher. At @brave I work on critical products like Brave Wallet - where a missed vulnerability can mean users lose funds. My personal projects, like sitebehavior.org, are fully open source.
Why does Daybreak need a government ID so I can analyze code I already maintain in public?
I get the dual-use concern. Attackers aren't filling out KYC forms. They are using open-weight models. The friction falls on defenders, the people you say you want to help.
Does that seem fair to you?
Why does Daybreak need a government ID so I can analyze code I already maintain in public?
I get the dual-use concern. Attackers aren't filling out KYC forms. They are using open-weight models. The friction falls on defenders, the people you say you want to help.
Does that seem fair to you?
Check out chatgpt.com/cyber to get Daybreak for individuals and openai.com/form/enterpris… for organizations.
We're here to help.
8
11
113
14,399
Alongside the exploit discussion, there is a longstanding privacy issue for people who never touch the car.
With Dashcam on, a Tesla records its surroundings while driving. With Sentry Mode on, it watches while parked and can save footage when it detects a security event. d Sentry recordings are saved in the car or on a USB drive, never on its servers. And, it collects operational and diagnostic data, receives camera clips owners opt into sharing for fleet learning, and says it can receive separate camera recordings following serious safety-critical events.
The owner chose to turn on recording. The people walking past did not. What protects them when that footage is kept, shared, or handed to police?
With Dashcam on, a Tesla records its surroundings while driving. With Sentry Mode on, it watches while parked and can save footage when it detects a security event. d Sentry recordings are saved in the car or on a USB drive, never on its servers. And, it collects operational and diagnostic data, receives camera clips owners opt into sharing for fleet learning, and says it can receive separate camera recordings following serious safety-critical events.
The owner chose to turn on recording. The people walking past did not. What protects them when that footage is kept, shared, or handed to police?
5
3
12
1,185
Perplexity sent the full text of my test searches to Datadog when the search arrived in the page URL. I captured the uploads live.
[That is how browsers send searches when Perplexity is the search engine.]
I usually break down privacy policies. This time, I followed what er.
I used harmless synthetic queries against the live website, without changing Perplexity’s code or stubbing responses. The query was stripped from the standard page-URL field sent to Datadog, but remained in two nested performance fields.
After the initial captures, I ran the follow-up tests shown in the image. It includes the conditions, results, and limits - including the runs where I did not observe query transmission.
One upload happened with Global Privacy Control enabled. Perplexity describes GPC and its cookie choices as opt-outs from targeted advertising.
What happened to the data after Datadog accepted it remains unknown.
@perplexity_ai @datadoghq @AravSrinivas @kpolley
[That is how browsers send searches when Perplexity is the search engine.]
I usually break down privacy policies. This time, I followed what er.
I used harmless synthetic queries against the live website, without changing Perplexity’s code or stubbing responses. The query was stripped from the standard page-URL field sent to Datadog, but remained in two nested performance fields.
After the initial captures, I ran the follow-up tests shown in the image. It includes the conditions, results, and limits - including the runs where I did not observe query transmission.
One upload happened with Global Privacy Control enabled. Perplexity describes GPC and its cookie choices as opt-outs from targeted advertising.
What happened to the data after Datadog accepted it remains unknown.
@perplexity_ai @datadoghq @AravSrinivas @kpolley
8
10
64
2,936
@josephfcox @404mediaco - would you be interested in taking a look? I can share network captures and the steps to reproduce what I observed.
0
0
8
278
Reminder: your Telegram DMs are NOT end-to-end encrypted by default.
Regular “cloud chats” are stored on Telegram’s servers with encryption keys Telegram controls. That means Telegram can access your contents.
Regular group chats have NO end-to-end encryption option, even when the group is set to private.
Even Secret Chats use MTProto, Telegram’s custom protocol, without Signal’s per-message key ratcheting or post-quantum key agreement.
Telegram’s privacy policy also says it may retain metadata such as your IP address, device information and username history for up to 12 months.
For private conversations, use @signalapp.
Regular “cloud chats” are stored on Telegram’s servers with encryption keys Telegram controls. That means Telegram can access your contents.
Regular group chats have NO end-to-end encryption option, even when the group is set to private.
Even Secret Chats use MTProto, Telegram’s custom protocol, without Signal’s per-message key ratcheting or post-quantum key agreement.
Telegram’s privacy policy also says it may retain metadata such as your IP address, device information and username history for up to 12 months.
For private conversations, use @signalapp.
Here's how exactly Telegram provides user data to U.S. authorities. A letter recently filed in court shows how Telegram transfers that data, such as IP address and phone number.
More: 404media.co/heres-what-tel…
114
59
304
35,239
Meta's release of Muse Spark Open, with 816B total parameters, 42B active, and a 1M-token context window, is a meaningful addition to the open-weight ecosystem.
The license deserves close attention, especially if you plan to build other models with it.
1. Commercial use is allowed. Offering Muse or derivatives as a model API/service requires notifying Meta and obtaining a separate written agreement beforehand if aggregate gross revenue across your organization and affiliates exceeds $20 million during any consecutive 12 months. Internal use, research, and non-MaaS commercial uses are expressly exempt from this clause.
2. "Derivatives" includes AI models trained, distilled, or improved using Muse outputs. Synthetic-data training can therefore bring downstream models within these obligations, even without copying Muse’s weights.
3. The usage policy prohibits intentionally circumventing/removing usage restrictions or safety measures, or enabling functionality Meta disabled. I do not see an explicit research/evaluation exception in that policy. That deserves clarification for researchers studying model safeguards.
4. Products and services using Muse or derivatives need prominent "Built with Muse Spark Open" attribution. Documentation, a website, or settings are permitted placements. Redistribution must preserve the copyright notice, license, and usage policy.
5. Meta claims no ownership of outputs, but disclaims warranties, including non-infringement.
The downstream-model definition and safeguard clause are the provisions I would scrutinize most. They affect how researchers can modify the model and what developers can build from its outputs.
Read the full license and usage policy: huggingface.co/meta-models/Mu…
The license deserves close attention, especially if you plan to build other models with it.
1. Commercial use is allowed. Offering Muse or derivatives as a model API/service requires notifying Meta and obtaining a separate written agreement beforehand if aggregate gross revenue across your organization and affiliates exceeds $20 million during any consecutive 12 months. Internal use, research, and non-MaaS commercial uses are expressly exempt from this clause.
2. "Derivatives" includes AI models trained, distilled, or improved using Muse outputs. Synthetic-data training can therefore bring downstream models within these obligations, even without copying Muse’s weights.
3. The usage policy prohibits intentionally circumventing/removing usage restrictions or safety measures, or enabling functionality Meta disabled. I do not see an explicit research/evaluation exception in that policy. That deserves clarification for researchers studying model safeguards.
4. Products and services using Muse or derivatives need prominent "Built with Muse Spark Open" attribution. Documentation, a website, or settings are permitted placements. Redistribution must preserve the copyright notice, license, and usage policy.
5. Meta claims no ownership of outputs, but disclaims warranties, including non-infringement.
The downstream-model definition and safeguard clause are the provisions I would scrutinize most. They affect how researchers can modify the model and what developers can build from its outputs.
Read the full license and usage policy: huggingface.co/meta-models/Mu…
Today we’re releasing Muse Spark Open, the most capable US open-weight model to date.
Built for coding and agentic work, it excels at long-horizon tasks, complex software engineering, and multi-step reasoning.
Key Model Specs:
→ 816B total / 42B active parameters
→ 1M token ly multimodal across text, image, video, audio
0
1
12
1,739
Next reverse-engineer targets:
- MathCraft (MATLAB)
- SolidCraft (SolidWorks)
- LedgerCraft (QuickBooks)
- VizCraft (Power BI / Tableau)
- BIMCraft (Autodesk Revit)
- TaxCraft (TurboTax)
Who’s building?
github.com/morluto/rea
- MathCraft (MATLAB)
- SolidCraft (SolidWorks)
- LedgerCraft (QuickBooks)
- VizCraft (Power BI / Tableau)
- BIMCraft (Autodesk Revit)
- TaxCraft (TurboTax)
Who’s building?
github.com/morluto/rea
JUST IN: Vibecoder reverse-engineers Microsoft Office using AI, releasing free, open-source alternatives to Word, Excel, & PowerPoint.
9
1
76
2,659
Hey @bot, about “take a picture of your credit card” and drop it in the chat:
- Is the image kept? For how long?
- Is the card number stored in chat history or synced anywhere?
- Who can access the full number: the model provider, merchants, or the bot developer?
- Does Privacy Mode change what is stored or who can access it?
- Who covers the cost if it orders the wrong item?
- Is the image kept? For how long?
- Is the card number stored in chat history or synced anywhere?
- Who can access the full number: the model provider, merchants, or the bot developer?
- Does Privacy Mode change what is stored or who can access it?
- Who covers the cost if it orders the wrong item?
To buy stuff, you can just take a picture of your credit card, drop it in the chat and Grok @bot will scour the Internet for the best deal on the item you want and order itCommunity notexAI explicitly warns users not to include personal information in prompts, yet credit card photos may contain such information.
Grok Bot's terms state that user data and credentials may be stored in its cloud environment and require human review for financial transactions.
x.ai/legal/privacy-…
x.ai/legal/grok-bot…
5
7
26
2,509
@poteto - suggesting a few privacy fixes for Grok Bot, if not already done:
1. Keep card numbers out of chats and transcripts. Detect them in text and photos, redact them before they reach the model, and send users to a secure entry field instead.
2. Per-chat and per-file delete, plus a retention timer, on every plan. The docs say deleting a Bot doesn't remove its files or browser sessions.
3. Network allowlists for everyone. The default is allow-all, and Network Controls are Enterprise only.
4. Separate browser profiles per Bot. The docs say all of a user's Bots share one computer.
Which of these are already on your roadmap? Happy to test any of them.
1. Keep card numbers out of chats and transcripts. Detect them in text and photos, redact them before they reach the model, and send users to a secure entry field instead.
2. Per-chat and per-file delete, plus a retention timer, on every plan. The docs say deleting a Bot doesn't remove its files or browser sessions.
3. Network allowlists for everyone. The default is allow-all, and Network Controls are Enterprise only.
4. Separate browser profiles per Bot. The docs say all of a user's Bots share one computer.
Which of these are already on your roadmap? Happy to test any of them.
2
1
13
551
DeMicrosoft 101: practical replacements for the Microsoft ecosystem
Outlook → @ProtonMail, @TutaPrivacy
Microsoft Photos → @enteio Photos
Bing → @brave Search
Edge → @brave
Microsoft Teams → @signalapp, @SimpleXChat
OneNote → @notesnook, @StandardNotes
OneDrive → Drive
Microsoft Password Manager → @Bitwarden, @Proton_Pass
Microsoft Authenticator → @enteio Auth, @Bitwarden Auth, @ProtonPrivacy Authenticator
Outlook Calendar → @ProtonPrivacy Calendar, @TutaPrivacy Calendar
Outlook Contacts → @ProtonPrivacy Contacts, @TutaPrivacy Contacts
Microsoft Copilot → @brave Leo, @asklumo
Microsoft Translator → @brave Translate
Microsoft Teams (video) → @brave Talk, @ProtonMeet
Windows → secureblue
Microsoft 365 → @fileverse, @LibreOffice, @cryptpad
SwiftKey → FlorisBoard, Apple Keyboard
Outlook → @ProtonMail, @TutaPrivacy
Microsoft Photos → @enteio Photos
Bing → @brave Search
Edge → @brave
Microsoft Teams → @signalapp, @SimpleXChat
OneNote → @notesnook, @StandardNotes
OneDrive → Drive
Microsoft Password Manager → @Bitwarden, @Proton_Pass
Microsoft Authenticator → @enteio Auth, @Bitwarden Auth, @ProtonPrivacy Authenticator
Outlook Calendar → @ProtonPrivacy Calendar, @TutaPrivacy Calendar
Outlook Contacts → @ProtonPrivacy Contacts, @TutaPrivacy Contacts
Microsoft Copilot → @brave Leo, @asklumo
Microsoft Translator → @brave Translate
Microsoft Teams (video) → @brave Talk, @ProtonMeet
Windows → secureblue
Microsoft 365 → @fileverse, @LibreOffice, @cryptpad
SwiftKey → FlorisBoard, Apple Keyboard
11
22
133
5,015
"The most secure platform for agents."
That's Microsoft's claim for agentic Windows. I am a privacy and security researcher, so I read the docs behind it.
Here's what Microsoft and GitHub's own documentation says:
- GitHub Copilot's local sandbox is OFF by default. Until you nds "use your credentials without restriction."
- Even with the sandbox on, Copilot's built-in file tools rely on "a software-only safeguard."
- On Windows, programs that ignore proxy settings can bypass the sandbox's network rules. GitHub doesn't document that gap on macOS.
- Copilot promises to "keep sensitive work on your device," but uses the cloud "when needed." Microsoft doesn't say how sensitive work is identified, what data can leave your PC, or how to force local-only processing.
- In Microsoft's own words: "local inference does not make the session offline."
- Microsoft's docs warn that cross-prompt injection can lead to "data exfiltration or malware installation."
"most secure" - HOW?
Against what threat model? I found no comparative evidence in the announcement.
Before you let an agent act on your PC:
1. Turn on sandboxing yourself.
2. Grant folder access narrowly.
3. Treat every page and document the agent reads as hostile.
4. Assume anything that isn't documented isn't guaranteed.
GitHub's sandbox docs: docs.github.com/en/copilot/con…
That's Microsoft's claim for agentic Windows. I am a privacy and security researcher, so I read the docs behind it.
Here's what Microsoft and GitHub's own documentation says:
- GitHub Copilot's local sandbox is OFF by default. Until you nds "use your credentials without restriction."
- Even with the sandbox on, Copilot's built-in file tools rely on "a software-only safeguard."
- On Windows, programs that ignore proxy settings can bypass the sandbox's network rules. GitHub doesn't document that gap on macOS.
- Copilot promises to "keep sensitive work on your device," but uses the cloud "when needed." Microsoft doesn't say how sensitive work is identified, what data can leave your PC, or how to force local-only processing.
- In Microsoft's own words: "local inference does not make the session offline."
- Microsoft's docs warn that cross-prompt injection can lead to "data exfiltration or malware installation."
"most secure" - HOW?
Against what threat model? I found no comparative evidence in the announcement.
Before you let an agent act on your PC:
1. Turn on sandboxing yourself.
2. Grant folder access narrowly.
3. Treat every page and document the agent reads as hostile.
4. Assume anything that isn't documented isn't guaranteed.
GitHub's sandbox docs: docs.github.com/en/copilot/con…
Today marks a new chapter for Windows, as we bring unmetered intelligence to every desk and every home, and make every PC a place where agents can work securely on your behalf.
Some highlights of what we announced:
• MAI-Code-1.1 Flash: 137B parameter coding model w/ 256K s now optimized to run on your PC!
• GitHub Copilot now hands off work to local models like MAI-Code-1.1 Flash, helping projects cost a lot less without sacrificing quality.
• With Hybrid Intelligence, Copilot can now take action directly on the PC and keep sensitive work on your device.
• And with Code in Copilot, you can essentially build any software you need on your desktop, without any cloud token spend, and it’s just super at it. You’re no longer limited to what’s in an app store! Your PC becomes an infinite software factory.
• Security is foundational to all this, which is why we are also bringing together Windows and Agent 365 so agents can work within secure boundaries on-device, including MXC a local sandbox for agent execution. Windows becomes your secure agent box!
• All this comes to life on a new generation of devices, like Surface Laptop Ultra, powered by NVIDIA RTX Spark.
Can’t wait to see what you build with all this.
6
4
20
1,359
I completed Section 1 of @TechloreInc Go Incognito: Second Edition.
If you are building a privacy setup, ask yourself these questions, adapted from @EFF’s security-planning guide:
- What information am I protecting?
- Who am I protecting it from?
- How likely is this threat to happen if protection failed?
- What effort can I realistically sustain?
- Who can help me protect it?
Apply these to one tool or habit you are thinking of changing. Use your answers to decide what fits your needs.
If you are building a privacy setup, ask yourself these questions, adapted from @EFF’s security-planning guide:
- What information am I protecting?
- Who am I protecting it from?
- How likely is this threat to happen if protection failed?
- What effort can I realistically sustain?
- Who can help me protect it?
Apply these to one tool or habit you are thinking of changing. Use your answers to decide what fits your needs.
Go Incognito v2 is live! 🚀
Section 1 is out now for premium students, with more sections on the way. Pre-launch pricing (25% off) ends tonight at 11:30PM pacific. Free version drops in the coming weeks!
All the details: techlore.tech/go-incognito-s…
2
3
26
1,093
For everyone who keeps asking why I am adding @Zcash but not @monero to my Tools directory - here is my response.
For hiding which earlier coins a transaction spends, I prefer Ironwood's design to Monero's current ring signatures. I am comparing Monero as it runs today with a that stays inside Zcash's Ironwood pool.
Monero hides each input among 16 ring members: the real output being spent and 15 other outputs used as decoys. The ages of those decoys need to resemble actual spending patterns. OSPEAD research (funded by the Monero community) found a mismatch between the two distributions.
Its preliminary estimate is that an adversary's best guess is right about 23.5% of the time on average, roughly 1 in 4.2, rather than the 6.25% of random guessing. The observer usually cannot confirm which guesses were right, and the best guess is still wrong most of the time. But the estimated hit rate is nearly 4 times random guessing.
Ironwood works differently. A spend proves the coin exists somewhere in the Ironwood pool, that the spender holds its key, and that the amounts add up, all without revealing which coin it was. The proof uses Halo 2, which needs no trusted setup. Each spend also publishes a nullifier, a unique tag that stops double spending without pointing back to the coin.
That leaves no list of candidates for decoy age analysis to rank. Some things are still visible, including fees, timing, and technical details like action counts, so wallet behavior and network privacy still matter. And proving a coin is somewhere in the pool does not make every coin in the pool an equally likely match.
Monero is developing FCMP++ to replace its rings of 16 with membership proofs covering eligible outputs across the chain, described by its developers as more than 150 million outputs. Zcash's shielded pools already prove membership across the whole pool, although FCMP++ is a different protocol with a different membership set. FCMP++ remains in beta stressnet (not active on Monero mainnet yet).
My recommendation specifically concerns fully shielded transfers that stay within one pool. For hiding which coins are spent under those conditions, Ironwood is the design I prefer today. FCMP++ will warrant a fresh comparison when it is deployed.
Corrections welcome from both sides.
For hiding which earlier coins a transaction spends, I prefer Ironwood's design to Monero's current ring signatures. I am comparing Monero as it runs today with a that stays inside Zcash's Ironwood pool.
Monero hides each input among 16 ring members: the real output being spent and 15 other outputs used as decoys. The ages of those decoys need to resemble actual spending patterns. OSPEAD research (funded by the Monero community) found a mismatch between the two distributions.
Its preliminary estimate is that an adversary's best guess is right about 23.5% of the time on average, roughly 1 in 4.2, rather than the 6.25% of random guessing. The observer usually cannot confirm which guesses were right, and the best guess is still wrong most of the time. But the estimated hit rate is nearly 4 times random guessing.
Ironwood works differently. A spend proves the coin exists somewhere in the Ironwood pool, that the spender holds its key, and that the amounts add up, all without revealing which coin it was. The proof uses Halo 2, which needs no trusted setup. Each spend also publishes a nullifier, a unique tag that stops double spending without pointing back to the coin.
That leaves no list of candidates for decoy age analysis to rank. Some things are still visible, including fees, timing, and technical details like action counts, so wallet behavior and network privacy still matter. And proving a coin is somewhere in the pool does not make every coin in the pool an equally likely match.
Monero is developing FCMP++ to replace its rings of 16 with membership proofs covering eligible outputs across the chain, described by its developers as more than 150 million outputs. Zcash's shielded pools already prove membership across the whole pool, although FCMP++ is a different protocol with a different membership set. FCMP++ remains in beta stressnet (not active on Monero mainnet yet).
My recommendation specifically concerns fully shielded transfers that stay within one pool. For hiding which coins are spent under those conditions, Ironwood is the design I prefer today. FCMP++ will warrant a fresh comparison when it is deployed.
Corrections welcome from both sides.
51
37
183
15,160
Sources:
OSPEAD findings, Monero blog: getmonero.org/2025/04/05/osp…
FCMP++ stressnet releases: github.com/seraphis-migra…
Ironwood pool spec, ZIP 229: zips.z.cash/zip-0229
OSPEAD findings, Monero blog: getmonero.org/2025/04/05/osp…
FCMP++ stressnet releases: github.com/seraphis-migra…
Ironwood pool spec, ZIP 229: zips.z.cash/zip-0229
1
0
13
803
I have kept adding to the Tools directory. It now has 146 tools across 51 categories.
The goal remains the same: help you choose tools that fit your threat model and everyday use.
Featured tools: @brave, @signalapp, @SimpleXChat, @RadarChat, @ProtonPrivacy, @Bitwarden, @Yubico, , @enteio, @notesnook, @fileverse, @goslnt, @Ubiquiti, @CapeCellular, @Zcash.
Still curated by me. No affiliate links, sponsorships, or paid rankings.
There are still gaps. If there is one tool or category you think deserves a closer look, tell me what you use and why.
profincognito.me/tools/
The goal remains the same: help you choose tools that fit your threat model and everyday use.
Featured tools: @brave, @signalapp, @SimpleXChat, @RadarChat, @ProtonPrivacy, @Bitwarden, @Yubico, , @enteio, @notesnook, @fileverse, @goslnt, @Ubiquiti, @CapeCellular, @Zcash.
Still curated by me. No affiliate links, sponsorships, or paid rankings.
There are still gaps. If there is one tool or category you think deserves a closer look, tell me what you use and why.
profincognito.me/tools/
57
112
840
22,692
AI agents sidestep the rule that web security rests on. The same origin policy stops one website from reading your data on another. An agent logged in as you is not bound by it. To every site, it is you.
Last year our team showed what that means in practice. We hid instructions in a Reddit comment behind a spoiler tag and asked Perplexity's Comet browser to summarize the page. The agent opened the user's Perplexity account page, copied their email, requested a one time password, read it from their logged in Gmail, and posted both as a reply to the comment. That is enough to take over the account, all from a summarize button.
Sriram is right that we need better primitives. The first one is old: do not let the agent be you. That is how we built AI browsing in Brave.
Our assistant Leo can suggest an agent task but cannot start one without your consent. Once you start it, the agent works in a separate profile that begins with none of your logins. It cannot open internal pages like settings, Web Store pages, non HTTPS sites or anything flagged by Safe Browsing. A second model checks its actions against what you asked for without directly reading page content, and anything it flags as risky waits for your approval. Everything happens in a tab you can watch and pause, and nothing is retained on our servers or used for training.
None of this solves prompt injection. It keeps a successful one out of the profile that holds your email and your bank. The code is open source and now in early testing.
Research: brave.com/blog/comet-pro…
Design: brave.com/blog/ai-browsi…
Last year our team showed what that means in practice. We hid instructions in a Reddit comment behind a spoiler tag and asked Perplexity's Comet browser to summarize the page. The agent opened the user's Perplexity account page, copied their email, requested a one time password, read it from their logged in Gmail, and posted both as a reply to the comment. That is enough to take over the account, all from a summarize button.
Sriram is right that we need better primitives. The first one is old: do not let the agent be you. That is how we built AI browsing in Brave.
Our assistant Leo can suggest an agent task but cannot start one without your consent. Once you start it, the agent works in a separate profile that begins with none of your logins. It cannot open internal pages like settings, Web Store pages, non HTTPS sites or anything flagged by Safe Browsing. A second model checks its actions against what you asked for without directly reading page content, and anything it flags as risky waits for your approval. Everything happens in a tab you can watch and pause, and nothing is retained on our servers or used for training.
None of this solves prompt injection. It keeps a successful one out of the profile that holds your email and your bank. The code is open source and now in early testing.
Research: brave.com/blog/comet-pro…
Design: brave.com/blog/ai-browsi…
whenever I see
- "claude/chatgpt has started debugging your browser"
- have to give an agent full disk and/or accessibility access
I'm convinced we need fundamentally better security primitives for agents to do work as us - and we are living in an awkward intermediate era.
6
2
24
1,171
Google Street View can show ANYONE your front door / driveway / visible security cameras without them ever visiting your street.
You can request a blur but that means giving Google proof of address and an email linked to your claim that you own or rent the home.
If you go u send. Use a forwarding email alias (like @SimpleLogin) you use nowhere else. This keeps your primary email out of the form [it does not make the request anonymous].
Use a utility bill dated within 6 months. Redact any sensitive information. Leave the address and document date visible. Do NOT upload a government ID.
Google says it permanently deletes uploaded documents after 60 days. Google’s requirements: support.google.com/maps/answer/15…
To request it: Google Maps → Street View → “Report a problem” → “My home.”
Upload the redacted proof, enter the address and submit.
Once applied, the blur is permanent. Your address remains searchable.
You can request a blur but that means giving Google proof of address and an email linked to your claim that you own or rent the home.
If you go u send. Use a forwarding email alias (like @SimpleLogin) you use nowhere else. This keeps your primary email out of the form [it does not make the request anonymous].
Use a utility bill dated within 6 months. Redact any sensitive information. Leave the address and document date visible. Do NOT upload a government ID.
Google says it permanently deletes uploaded documents after 60 days. Google’s requirements: support.google.com/maps/answer/15…
To request it: Google Maps → Street View → “Report a problem” → “My home.”
Upload the redacted proof, enter the address and submit.
Once applied, the blur is permanent. Your address remains searchable.
4
8
29
1,820
If you are being stalked, harassed or doxxed, blurring is one way to reduce publicly available imagery of your home.
Black boxes on a PDF can leave the underlying text intact. Apply proper redactions / upload a screenshot of the visibly redacted page.
Apple Maps has its own street imagery - Look Around. Request a blur of your home separately by emailing MapsImageCollection@apple.com.
Use a different forwarding alias for that request.
Apple’s instructions: maps.apple.com/imagecollectio…
Black boxes on a PDF can leave the underlying text intact. Apply proper redactions / upload a screenshot of the visibly redacted page.
Apple Maps has its own street imagery - Look Around. Request a blur of your home separately by emailing MapsImageCollection@apple.com.
Use a different forwarding alias for that request.
Apple’s instructions: maps.apple.com/imagecollectio…
1
0
11
338