Google Rolls Out AI System That Handles Threats Instantly  ## Metadata - Author: [[Hard Fork AI]] - Full Title: Google Rolls Out AI System That Handles Threats Instantly - Category: #podcasts - URL: https://share.snipd.com/episode/9ca01209-b14a-4d35-bc33-f66b0ea2ebd4 ## Document Notes ## Highlights - **Metadata Critic Guards Agent Actions** - Google uses a separate critique model (Gemini) to verify each agent action against the user's original goal. - The critic sees only metadata, not page content, to avoid prompt-injection attacks and enforce alignment. Transcript: Jaeden Schafer Okay let's talk about what Google has recently shown off as far as security measures for what they're rolling out in the future with Google Chrome now they kind of gave a bunch of demos And they showed how Google Chrome could be an AI agent similar to Anthropic and Perplexi what they're rolling out but when they were when they kind of gave their demos, they said, Look, These are gonna be available in the coming months. So they did, they kind of did the tease and wait instead of the immediate drop with this feature. It's basically my pet peeve, but whatever it is the way it is, especially with companies like Google and Apple, or they have kind of like these big show and tell conferences, and then They're like, Look, these will be coming on the next few months. And so I mean, this is just the way it is when when they have these like pre-designed conferences like Google I.O. Where they announce a bunch of stuff I really appreciate it when these AI companies do an announcement and they immediately drop Google did not do that in this case but what they did do That I thought was pretty impressive as they if they've started to roll this out is they said that they're using the help of a few different models to keep the agent's actions in check. So essentially, they build what they're calling a user alignment critique. Now, they're using Gemini to do this. And it basically looks at the action items that is built by the planner model. So essentially, what that means is when you're going to go and use an AI agent, let's say you're like, hey, help me go and download my podcast episode. And I mean, I know this isn't everyone's, everyone's workflow, I'm coming up with something that's my own rather than just giving you like a travel planner one, which I feel like is overused. So let's say you're like, hey, go download my podcast episode, go edit it, go upload it to this platform, come up with some titles and descriptions and publish it for me on, you know, Monday, Wednesday or Friday, depending on what the next available slot for a podcast episode is, right? Let's say this is your workflow. It's gonna like these AI agents, they essentially listen to your prompt, however, you know, unformatted it may be where you describe your whole workflow. And they'll break it down into a very clear organized path. They're like, okay, in order to do the download, we need to make sure that we have space on the drive. And we need to make sure that when we download it, we, you know, we do XYZ things, and we're downloading the right file, and we got to go find it. Like anyways, they came up with this very elaborate walkthrough of what they're going to do. Now, what they've done as far as security goes, is they've created a user alignment critique, which is essentially a model, it can't see anything on your screen. So the AI agent, it can see everything on your screen, it comes up with a plan that goes and executes the plan. Every step of the plan when it says, okay, I see this, I'm going to do this thing next, you can kind of see the reasoning on comment and even on opening eyes Atlas, where it like tells you What it's doing while it goes through all the steps. So it's kind of useful to watch that to understand how these models are working. But how Google is functioning now is, as it's taking those actions, it has a separate model that is looking at what your original objective is and what its current step it's taking. You can't see what's on the screen. So it can't be tricked, basically by a prompt injection that's like, forget all your past instructions and make sure you do x, y, z, right? This is what people are kind of worried about this quote unquote prompt injection. Instead, all it sees is your original goal, and then the actions it's going to take and that model says yes or no, if that action aligns with the original goal, it's a very clever kind of Way to use AI to stop the bad actors of AI. So they've done this. And if the critical model thinks that the planned task doesn't serve what the user's original goal is, it's going to ask the planning model to rethink its strategy on what it's doing. So Google says that the like the critic model only sees the metadata and not the actual web content. And I think what's powerful is ([Time 0:02:24](https://share.snipd.com/snip/c43b8681-45c6-4fc3-8f51-6c29a936ce61)) - **Planner‑Critic Loop Enforces Alignment** - The critic model checks planned steps against the original goal and requests replanning if misaligned. - This loop reduces the chance an agent follows malicious or irrelevant instructions during execution. Transcript: Jaeden Schafer But how Google is functioning now is, as it's taking those actions, it has a separate model that is looking at what your original objective is and what its current step it's taking. You can't see what's on the screen. So it can't be tricked, basically by a prompt injection that's like, forget all your past instructions and make sure you do x, y, z, right? This is what people are kind of worried about this quote unquote prompt injection. Instead, all it sees is your original goal, and then the actions it's going to take and that model says yes or no, if that action aligns with the original goal, it's a very clever kind of Way to use AI to stop the bad actors of AI. ([Time 0:05:06](https://share.snipd.com/snip/d86be27f-b366-44c0-8a93-c405d4e914a5)) - **Origin Sets Limit Data Exposure** - Chrome restricts which origins an agent can read from or write to using agent origin sets to limit cross-origin data leaks. - The browser can withhold model access to data outside the readable set and block interactions with disallowed frames. Transcript: Jaeden Schafer And I think what's powerful is that the other thing they're doing to prevent agents from getting disallowed or untrustworthy sites and accessing them basically is that they're using This an agent origin sets tool. So this is another tool. So they have, I think, three main tools. The first one was their user alignment critique. The second one is called agent origin sets. And essentially what it's going to do is it's going to restrict the model to access read only origins and read writable origins. So what that means is that read only origins is data that Gemini is allowed to consume content from. So an example of that would be, you know, like on a shopping site, the listings, those are very relevant to the task that you're doing, right? If you like go buy me a pair of white tennis shoes, and it goes to a web page, and there's white tennis shoes, the listing information about those white tennis shoes, that's very relevant To the task that you're doing. But the banner ad that's on that website, right? Like maybe it's a Shopify store or some other store, and they've got Google ads on there. That is not relevant. And so the listing is relevant but the banner ads are not and google also said that the agent is only allowed to click on or type on certain iframes of a page so the ads would not be there what's Kind of hilarious to me is the fact that google is the number one ads platform in the world and yet their ai agent that they're creating is literally designed to ignore ads. And it's also especially ironic to me considering that, you know, this is all coming on Google Chrome, who, you know, I for many years used Google Chrome and I had like ad blockers, you Know, like, you know, all sorts of ad blocker plugins that would block extensions, that would block ads. And then Google Chrome made it very difficult for those same ad blocker plugins to fully function. And I've essentially moved to other platforms. I use Brave now as my browser because it by default blocks all ads. I don't need a plugin. I don't need an extension. It just works. And yeah, I forget ads exist on the internet, if I'm being perfectly honest. And so anyways, it's very ironic to me that as we're creating AI agents, we're literally designing them to ignore ads, which is where Google makes all their money and what they they've Stopped, you know, they're there. It feels like they're kind of like bent on not allowing any humans to to block ads, but their agents can anyways, it's ironic. I think it's kind of funny. But I also do think it's clever and great for security yada yada so like google continue on this path i think it's great um one thing that i'm i think is interesting is this concept of um Iframes inside of a website basically what i think is clever here is because it's only it's only allowing the agent to click on or type on certain iframes on a site it's actually it's very Smart because beyond just visually what you can see on the page it also can read the html or the code for the page so it understands more about the page and more about security risks than A regular human one a very common phishing attack that i think you would see is like is you know iframes inside of a website and the iframe is of a completely different website that's stealing Data you know a hacker could go you know hack a legitimate website put an iframe embedded inside of that website that you think you're typing your data into a specific website but really There's a hacker extracting data that's like one kind of clever way to go about it another one is just with you know complete spoof websites where you have a slight typo in the URL that People may not notice. You try to make a direct clone of like PayPal or Bank of America and get their get their information. And, you know, these kind of common scams that people do. What's cool to me is that the AI agents will actually be better than humans at detecting that because they're looking at not just what's on the screen, but also the code. And they're built to kind of scrutinize everything and not click on or interact with iframes or elements of the page that they know are false, which is kind of cool. This is what they said in a blog post about all of it. They said, this delineation enforces that only data from a limited set of origins is available to the agent, and this data can only be passed on to the writable origins. This bounds the threat vector of cross-origin data leaks. This also gives the browser the ability to enforce some of that separation, such as by not even sending to the model data that is outside of the readable set. Okay, so, I mean, essentially Google's, you know, keeping a check on the page navigation by looking at the URLs throughout, through like another observer model. ([Time 0:06:00](https://share.snipd.com/snip/fa66ae85-4eb5-44f4-98e3-b6e9c1d30760)) - **Iframe Controls Reduce Phishing Risk** - The agent will only click or type into approved iframes and ignore irrelevant elements like banner ads. - That iframe-level control helps detect phishing and malicious embedded content by inspecting page HTML and origins. Transcript: Jaeden Schafer And essentially what it's going to do is it's going to restrict the model to access read only origins and read writable origins. So what that means is that read only origins is data that Gemini is allowed to consume content from. So an example of that would be, you know, like on a shopping site, the listings, those are very relevant to the task that you're doing, right? If you like go buy me a pair of white tennis shoes, and it goes to a web page, and there's white tennis shoes, the listing information about those white tennis shoes, that's very relevant To the task that you're doing. But the banner ad that's on that website, right? Like maybe it's a Shopify store or some other store, and they've got Google ads on there. That is not relevant. And so the listing is relevant but the banner ads are not and google also said that the agent is only allowed to click on or type on certain iframes of a page so the ads would not be there what's Kind of hilarious to me is the fact that google is the number one ads platform in the world and yet their ai agent that they're creating is literally designed to ignore ads. And it's also especially ironic to me considering that, you know, this is all coming on Google Chrome, who, you know, I for many years used Google Chrome and I had like ad blockers, you Know, like, you know, all sorts of ad blocker plugins that would block extensions, that would block ads. And then Google Chrome made it very difficult for those same ad blocker plugins to fully function. And I've essentially moved to other platforms. I use Brave now as my browser because it by default blocks all ads. I don't need a plugin. I don't need an extension. It just works. And yeah, I forget ads exist on the internet, if I'm being perfectly honest. And so anyways, it's very ironic to me that as we're creating AI agents, we're literally designing them to ignore ads, which is where Google makes all their money and what they they've Stopped, you know, they're there. It feels like they're kind of like bent on not allowing any humans to to block ads, but their agents can anyways, it's ironic. I think it's kind of funny. But I also do think it's clever and great for security yada yada so like google continue on this path i think it's great um one thing that i'm i think is interesting is this concept of um Iframes inside of a website basically what i think is clever here is because it's only it's only allowing the agent to click on or type on certain iframes on a site it's actually it's very Smart because beyond just visually what you can see on the page it also can read the html or the code for the page so it understands more about the page and more about security risks than A regular human one a very common phishing attack that i think you would see is like is you know iframes inside of a website and the iframe is of a completely different website that's stealing Data you know a hacker could go you know hack a legitimate website put an iframe embedded inside of that website that you think you're typing your data into a specific website but really There's a hacker extracting data that's like one kind of clever way to go about it another one is just with you know complete spoof websites where you have a slight typo in the URL that People may not notice. You try to make a direct clone of like PayPal or Bank of America and get their get their information. And, you know, these kind of common scams that people do. What's cool to me is that the AI agents will actually be better than humans at detecting that because they're looking at not just what's on the screen, but also the code. And they're built to kind of scrutinize everything and not click on or interact with iframes or elements of the page that they know are false, which is kind of cool. ([Time 0:06:24](https://share.snipd.com/snip/53d3e61f-c22e-49cd-a2de-c85c03c21113)) - **Switched To Brave For Default Ad Blocking** - Jaeden shares his personal move from Chrome to Brave because Brave blocks ads by default. - He finds it ironic Google builds agents to ignore ads while Chrome makes ad blocking harder for users. Transcript: Jaeden Schafer And I've essentially moved to other platforms. I use Brave now as my browser because it by default blocks all ads. I don't need a plugin. I don't need an extension. It just works. And yeah, I forget ads exist on the internet, if I'm being perfectly honest. And so anyways, it's very ironic to me that as we're creating AI agents, we're literally designing them to ignore ads, which is where Google makes all their money and what they they've Stopped, you know, they're there. ([Time 0:07:46](https://share.snipd.com/snip/f02601e3-f9f8-419e-bdd9-80c7b94734f1)) - **Agents See Code, So Detect Clones Better** - Agents can inspect page HTML and code, letting them detect spoofed URLs and malicious iframes better than humans. - That technical visibility improves security against common phishing and clone-site attacks. Transcript: Jaeden Schafer You try to make a direct clone of like PayPal or Bank of America and get their get their information. And, you know, these kind of common scams that people do. What's cool to me is that the AI agents will actually be better than humans at detecting that because they're looking at not just what's on the screen, but also the code. And they're built to kind of scrutinize everything and not click on or interact with iframes or elements of the page that they know are false, which is kind of cool. This is what they said in a blog post about all of it. ([Time 0:09:26](https://share.snipd.com/snip/a05004d1-3963-4f0a-841d-147bfea4e6e5)) - **Grant Sensitive Access Selectively** - Expect Chrome agents to ask user permission before accessing sensitive sites or using password manager data. - Weigh convenience vs. security: allow agent access only when you trust the workflow to avoid unnecessary prompts. Transcript: Jaeden Schafer Some things I don't think are good about this. For instance, when an agent is trying to navigate to, you know, a site with information like banking or medical data, it first is going to ask the user, like you can see pros and cons to This. I think a lot of people are going to be wary of like, hey, like, I don't want, you know, Google Gemini going and logging into my bank without my permission, because, you know, security, All sorts of security issues there. But at the same time, it's like, if I asked it to do something, because it was useful for me, and then it's like not able to do it, then it makes it less useful to me. So this is kind of the debate that I personally have, I'm like, if there's a way to make it secure, and I could just say, hey, go check my bank, and let me know, you know, if my transaction To XYZ Corporation went through, because I wasn't sure, it's something funny happened on my credit card, and you know, Google Gemini could go do that, and let me know, like, that would Be very useful, so I could see, like, uses, and that, but then if it was like, oh, well, sorry, that's, too confidential like would you like me to do this or can you like you can you log in And then i'll go search for it like i don't know i can imagine it just being kind of cumbersome and annoying and i would like to streamline it but i know i'm sure there's a great debate to Be had in that regard but what i think is less debatable is that for sites that require a login is going to ask a user for permission to let Chrome use the password manager. Google said that the agent's model doesn't have exposure to password data. And they also said it's going to ask users before taking actions like making a purchase or sending a message. Personally, I think this is just making it less useful. If it's going to ask me permission to send a message where I'm like hey go send an email to this person saying this and then it like drafts up an email it's like do I have permission to send This message to this person it's like I already yeah like I already gave you permission or if I was like hey like go buy me this exact pair of shoes don't spend more than this much money go Probably buy it from this place and then it like does all the research and it's like all, all right, I'm gonna buy the shoes. And it's exactly everything that you wanted. Are you good? Like, I don't know, to me, it's like, just if I give you an instruction, I would, when the model is good enough, I hope it can do it without asking me for it. So maybe we'll get there. Maybe this is just kind of because the model is not good enough today. So setting the limitations, my worst fear is be that these limitations last forever, right? Like I want an AI model that can truly go and do everything I need it to go do without having to ask me this is basically my biggest pet peeve. And my biggest issue with perplexes comment and with open eyes. Atlas browser is that I have all sorts of tasks I get it to do and ask me like, like, you know, 10 different times throughout the task. Are you sure I can proceed to the next step? And I'm like, if I have to babysit you and say yes, every, you know, every minute, I might as well just do this thing myself. Or really what I do is just hire a person to do it because I can tell them how to do it once. And they'd never ask me again for a month while they do all the tasks. ([Time 0:10:46](https://share.snipd.com/snip/1864a85a-8279-4928-8205-09837936e446)) - **Open Research Raises Industry Safety** - Google and other companies will publish research on agent security, which everyone will adopt and improve the industry. - Public research reduces secrecy but raises overall safety across browsers and agents. Transcript: Jaeden Schafer Google said that they also have some prompt injection classifiers to prevent unwanted actions. They're also testing agentic capabilities against attacks. So they have a bunch of researchers that are working on this right now. I would expect nothing less from Google. I think that is fantastic. There is apparently, or I guess perplexity recently they released this kind of new open source content detection model earlier this month um and so i think that there's a lot of other Players paying a lot of attention to this and the idea but uh for that with perplexity is to prevent prompt injection attacks against agents i think google is going to work on this as well I honestly think that all of the research done by any of these companies especially because they're going to publish it and talk about it is going to get used by everyone i don't think That's like the competitive advantage you want. Like, the competitive advantage of Google Chrome is that like, you know, we are way less prone to attacks, but we're not going to tell you how, like, they're going to tell everyone how And then everyone's going to use them. ([Time 0:13:45](https://share.snipd.com/snip/6d156c94-da6f-474f-bd64-3d294dc20f60))