#security

Small on-device models are getting good enough to sit in front of the big ones. Rampart from the National Design Studio redacts PII in the browser before a prompt reaches any LLM: regexes with checksum or structural checks for cards (Luhn), SSNs, emails, URLs and IPs, plus a fine-tuned MiniLM for names, phones, account numbers, government IDs and street addresses. discuss

• 14.7 MB Q4 ONNX (~15 MB with tokenizer), 98.4% private-term recall across seven Latin-script languages. p50 is 3.9 ms on WebGPU but 12.6 ms on the default WASM backend. OpenAI's Privacy Filter is ~2.8 GB; Presidio scores 65% on the same test set.
• guard.protect() swaps PII for placeholders like [GIVEN_NAME_1], and guard.reveal() fills them back into the reply. The LLM never sees the name; the user still does.
• Default-deny: every detected label is redacted except city, state and ZIP, so the assistant keeps coarse location without the street line.
• Know the gaps: names in non-Latin scripts recall ~14% (Hindi 6%, Arabic 5%), and it scores 86.4% on a hostile-input suite. The repo calls it harm reduction, not perfect protection.
• Same size class, different job: Cactus Whistle is 16.9 MB speech-to-text in seven languages, 11 ms to first token on an M4 Pro CPU (Whisper base: 145 MB, 73 ms). It loads into the same engine as Needle 3, their tool-calling model, so one call takes audio in and returns set_lights(room="kitchen", on=false). Voice commands for home automation with no cloud round trip.
• The pattern: a tiny specialist at the edge does one narrow job (redact, transcribe, route), and the big model only sees what it needs. Both sets of benchmarks are vendor-reported.

Microsoft eXecution Container (MXC) is an embeddable SDK for running untrusted commands under OS-enforced policies, not a hosted sandbox service. discuss

• Defaults: Seatbelt on macOS, Bubblewrap on Linux, ProcessContainer on Windows. SDKs for Node, Rust, and .NET.
• Restricts filesystem and network access. macOS hostname allowlists need a caller-managed proxy; not every backend is a VM.
• Useful boundary: sandbox the command where it executes, not just the agent's tool-composition script. Isolation limits damage; it does not make generated output trustworthy.

SecretSpec declares secrets once in secretspec.toml (names + descriptions, never values) and resolves them from any of 11 backends: keyring, 1Password, Vault, AWS, GCP, .env. Same command everywhere: secretspec run --profile production -- npm start. Per-secret fallback chains (providers = ["vault", "keyring", "env"]) and a ref = { item, field } form points at a secret you already have elsewhere, no renaming. Sharpest bit: agents get held to a stricter bar by default. require_reason = "agents" forces secretspec run --reason "..." before an AI agent can read a secret, appended to a local audit log; humans running interactively are unaffected. Rust core, SDKs for Python/Go/Node/Ruby/PHP/Haskell. Worth piloting on a project drowning in .env sprawl.

Opus 4.6 launch.

• context compaction (beta) and 1M context window, enables longer agentic tasks without loosing context.
• they claim it has found 500 Zero-Day Flaws in open-source projects (yet to see the proofs though)
• agent teams, multiple agent coordinates with a leader agent. https://code.claude.com/docs/en/agent-teams

On blockchain, UIPC (Universal IPC) and SIPC (Secure IPC) are frameworks that allows different network to talk to each other using a standard protocol. While UIPC acts as the universal courier, SIPC acts as the security guard. Together, they create "Internet of Blockchains". Gemini

• Cosmos IBC & Polkadot - XCM are two industry leading protocols for UIPC
• For the SIPC, Zero-Knowledge Proofs and Rollup architecture also "Trustless bridges" or "Cross-rollup communication" are often more frequently used terms in blockchain literatures.