It seems like the spec has considered a couple approaches: registering JavaScript tools, which have names and descriptions communicated just to the user's agent, and annotating/marking up forms.
While prompt injection with natural language will be a rampant problem no matter what, it seems like a safer direction might be to put instructions and intentions of tools into the visible UI, rather than the method of registering tools invisibly to the user. If the AI agent helps the user take action through the visible controls, the user can maybe see whether something is misleading, or if it's the same surface, at least having it visible makes it easier for some human user to notice the attack.
That might also have accessibility improvements, so that functionality isn't hidden from visitors who aren't using AI agents, for example.
It seems like the spec has considered a couple approaches: registering JavaScript tools, which have names and descriptions communicated just to the user's agent, and annotating/marking up forms.
While prompt injection with natural language will be a rampant problem no matter what, it seems like a safer direction might be to put instructions and intentions of tools into the visible UI, rather than the method of registering tools invisibly to the user. If the AI agent helps the user take action through the visible controls, the user can maybe see whether something is misleading, or if it's the same surface, at least having it visible makes it easier for some human user to notice the attack.
That might also have accessibility improvements, so that functionality isn't hidden from visitors who aren't using AI agents, for example.