#security

Small on-device models are getting good enough to sit in front of the big ones. Rampart from the National Design Studio redacts PII in the browser before a prompt reaches any LLM: regexes with checksum or structural checks for cards (Luhn), SSNs, emails, URLs and IPs, plus a fine-tuned MiniLM for names, phones, account numbers, government IDs and street addresses.

• 14.7 MB Q4 ONNX (~15 MB with tokenizer), 98.4% private-term recall across seven Latin-script languages. p50 is 3.9 ms on WebGPU but 12.6 ms on the default WASM backend. OpenAI’s Privacy Filter is ~2.8 GB; Presidio scores 65% on the same test set.
• guard.protect() swaps PII for placeholders like [GIVEN_NAME_1], and guard.reveal() fills them back into the reply. The LLM never sees the name; the user still does.
• Default-deny: every detected label is redacted except city, state and ZIP, so the assistant keeps coarse location without the street line.
• Know the gaps: names in non-Latin scripts recall ~14% (Hindi 6%, Arabic 5%), and it scores 86.4% on a hostile-input suite. The repo calls it harm reduction, not perfect protection.
• Same size class, different job: Cactus Whistle is 16.9 MB speech-to-text in seven languages, 11 ms to first token on an M4 Pro CPU (Whisper base: 145 MB, 73 ms). It loads into the same engine as Needle 3, their tool-calling model, so one call takes audio in and returns set_lights(room="kitchen", on=false). Voice commands for home automation with no cloud round trip.
• The pattern: a tiny specialist at the edge does one narrow job (redact, transcribe, route), and the big model only sees what it needs. Both sets of benchmarks are vendor-reported.

Microsoft eXecution Container (MXC) is an embeddable SDK for running untrusted commands under OS-enforced policies, not a hosted sandbox service.

• Defaults: Seatbelt on macOS, Bubblewrap on Linux, ProcessContainer on Windows. SDKs for Node, Rust, and .NET.
• Restricts filesystem and network access. macOS hostname allowlists need a caller-managed proxy; not every backend is a VM.
• Useful boundary: sandbox the command where it executes, not just the agent’s tool-composition script. Isolation limits damage; it does not make generated output trustworthy.

SecretSpec declares secrets once in secretspec.toml (names + descriptions, never values) and resolves them from any of 11 backends: keyring, 1Password, Vault, AWS, GCP, .env. Same command everywhere: secretspec run --profile production -- npm start. Per-secret fallback chains (providers = ["vault", "keyring", "env"]) and a ref = { item, field } form points at a secret you already have elsewhere, no renaming. Sharpest bit: agents get held to a stricter bar by default. require_reason = "agents" forces secretspec run --reason "..." before an AI agent can read a secret, appended to a local audit log; humans running interactively are unaffected. Rust core, SDKs for Python/Go/Node/Ruby/PHP/Haskell. Worth piloting on a project drowning in .env sprawl.

Opus 4.6 launch.

• context compaction (beta) and 1M context window, enables longer agentic tasks without loosing context.
• they claim it has found 500 Zero-Day Flaws in open-source projects (yet to see the proofs though)
• agent teams, multiple agent coordinates with a leader agent. https://code.claude.com/docs/en/agent-teams

On blockchain, UIPC (Universal IPC) and SIPC (Secure IPC) are frameworks that allows different network to talk to each other using a standard protocol. While UIPC acts as the universal courier, SIPC acts as the security guard. Together, they create “Internet of Blockchains”. Gemini

• Cosmos IBC & Polkadot - XCM are two industry leading protocols for UIPC
• For the SIPC, Zero-Knowledge Proofs and Rollup architecture also “Trustless bridges” or “Cross-rollup communication” are often more frequently used terms in blockchain literatures.

actions/checkout saves the workflow token (GITHUB_TOKEN or a custom one) in the checked-out repo’s .git/config by default. Workflows that upload the repo as an artifact leak it, and Unit 42 found many projects doing this. GitHub calls it intended behaviour. Turn it off, and scan workflows with zizmor, which would have caught the Ultralytics injection.

- uses: actions/checkout@v4
  with:
    persist-credentials: false