Jonathan Kingston

Appropriateness is what safety cannot mechanise

Mon, 08 Jun 2026 00:00:00 +0000

In the first post, I argued that the lethal trifecta is a capability test, not a safety model. Above capability sit further checks: contextual integrity and deployment policy, authority, and appropriateness for the recipient. The first post covered capability through authority. Build those controls and you have something defensible.

The trifecta tells you what an agent can do

Mon, 08 Jun 2026 00:00:00 +0000

The lethal trifecta is the security heuristic I reach for most often with agents. Private data, untrusted content, an exfiltration path: hold all three in one context and you have a confused deputy waiting to happen. I walked through what that looks like for browser agents in an earlier post. Simon Willison named the pattern clearly in June 2025, and it has been the easiest way to explain indirect prompt injection to people who do not read security papers.

When agents browse the web, the web wins

Sun, 10 May 2026 00:00:00 +0000

A new paper, WAAA! Web Adversaries Against Agentic Browsers, frames web pages as hostile software to agentic browsers.

Stop asking junior engineers to struggle harder

Tue, 03 Mar 2026 00:00:00 +0000

Four pieces landed in the past two weeks that circle the same problem from different altitudes.

Context gathering for AI: a tradeoff guide

Mon, 02 Mar 2026 00:00:00 +0000

When you wire AI into a workflow, the choice of model matters less than you might expect - often the harder question is "how does the model get the context it needs?"

Consent is all you need

Sun, 22 Feb 2026 00:00:00 +0000

The agentic web has a consent problem. Every agent depends on the same unstated assumption: the model knows when it should stop and ask you.

Magic words need measuring sticks

Tue, 17 Feb 2026 00:00:00 +0000

Dave Rupert's Magic Words names a thing I've been stewing on. Skills, MDC rules, and system prompts are all incantations. We write them, ship them, and hope. He frames them as magic numbers: values that work for reasons we can't articulate, in conditions we can't reproduce. I think he's onto something. But I also think the bigger issue may be that we're not measuring whether these words work.

A Case for poster on Canvas

Sun, 11 Jan 2026 00:00:00 +0000

The HTML element has a gap that solved years ago: there's no declarative way to provide a static visual representation. When JavaScript hasn't run, can't run, or the page is being archived, canvas content vanishes. I think a poster attribute could fix this.

Breaking into realism with AI

Tue, 23 Dec 2025 00:00:00 +0000

AI isn't magic. It hallucinates, misses context, and confidently produces junk. But if you understand where it's useful, it becomes powerful for amplifying what you do.

Containers website assignment

Tue, 04 Apr 2017 00:00:00 +0000

At Mozilla we have been working on a feature called containers, which gives users the ability to separate their lives online to prevent being tracked.

role="password" is not wise

Mon, 16 May 2016 00:00:00 +0000

TL;DR: ARIA is a hack on real accessibility, reimplementing HTML in ARIA is silly, subverting password managers is evil, expecting the developers to start using role="password" likely wont happen, CSS replaced elements can't use pseudo elements and we should just fix that.

Client side armour

Mon, 02 Mar 2015 00:00:00 +0000

Out of the shadows

Sun, 22 Feb 2015 00:00:00 +0000

Making a dynamic palette today

Wed, 16 Jul 2014 00:00:00 +0000

Creating dynamic CSS doesn't sound exciting, however it is certainly a time management issue of large scale sites on the web. This has lead to the advancement of preprocessing CSS and other methodologies like OOCSS and SMACSS which bring their own issues too.

VALIDATE me baby

Thu, 10 Jul 2014 00:00:00 +0000

There are many times that I have been writing sites with the desire for the client side to call the server in a safe and idempotent way with a request body for sending more data than a GET can, or data that can't be recorded via referral logs.

Google as a Service (GaaS)

Wed, 25 Jun 2014 00:00:00 +0000

Google appears to be pushing further into the open internet platform in a land grab bid against closed source providers. As other articles are suggesting, Google is pushing the 'Android everywhere' idea however I am seeing this more as a two pronged approach with an 'Internet everywhere' approach as the main driver for Google's other profitable offerings.

My new favourite colour

Fri, 20 Jun 2014 00:00:00 +0000

The all new CSS colour: 'rebeccapurple' which is backed with one of the most moving stories I have heard in a long time.

Making a performance

Wed, 05 Mar 2014 00:00:00 +0000

Don't over optimise too early

A common trend I see more in JavaScript, than in any other language is to over optimise every line of code. This comes in many flavours but the two most common are:

Why I now love CSS Values and Units module

Mon, 03 Mar 2014 00:00:00 +0000

What I first thought

Give the world back FollowRedirects XMLHttpRequest

Fri, 08 Nov 2013 00:00:00 +0000

So having written enough heavy AJAX applications I can tell you that a massive frustration is that there is not any ability to detect natively when the browser follows a redirect over AJAX, this makes handling redirection difficult in the client.

Trialling laravel PHP

Fri, 25 Oct 2013 00:00:00 +0000

Laravel was suggested to me last week and I have only just got time to take a look at it properly.

Pushing restart on blogging

Mon, 21 Oct 2013 00:00:00 +0000

I have been inspired to write blogs over the years, without ever making more than several posts before quitting.