
Co-founder @pixiebrix. Machine ✘ Human Intelligence
New York, USA
Joined December 2015
- Tweets38
- Following75
- Followers42
- Likes166
Extensibility Radar, three shifts this week in what you can customize and automate in the software you already use:
MCP's next spec goes stateless
Browsers weigh softer extension permission prompts
ChatGPT Business adds a plugin control plane
Unpacking each. (1/7)
ChatGPT Business added a plugin control plane. Admins manage plugins from Workspace settings: install policy, roles, categories, member-installable vs workspace-wide. The question shifts from what a plugin can do to who inside an org can install it. (6/7)
Full issue, plus the Wasmer interruptible-Wasm and Daytona notes:toddschiller.com/blog/extens… (7/7)
The infrastructure for running other people's code became a product this week.
AWS, the W3C, and Figma all shipped or formalized something that changes what your users can run, build, and extend inside your software. Four signals worth knowing 👇
3. Figma shipped generative plugins.
Describe a tool in plain language, its agent builds the plugin, no plugin API knowledge required. Rolling out gradually, but the authoring barrier just collapsed for a huge non-developer audience.
4. Atlassian launched "Enterprise Certified": marketplace trust signals (SOC 2, ISO 27001, pen testing) going machine-verifiable, the same week a plugin registry showed what happens when trust is policy-only.
Full breakdown: toddschiller.com/blog/extens…
Genetic hitchhiking: a useless trait spreads by sitting next to a beneficial one on the chromosome.
Beliefs do the same. Jocko Willink and Wim Hof rode Tim Ferriss into their own followings, adjacent beliefs and all.
New explorer for AI, wellness, climate: toddschiller.com/artifacts/b…
Your AI agent on a fresh page is one prompt injection from leaking creds, one dark pattern from a bad buy, one fake review from a bad rec.
agent-browser-shield is a free extension that blocks all three. Live on Product Hunt today, every upvote helps:
producthunt.com/products/age…
Two days after the alpha announcement, agent-browser-shield has a Chrome Web Store listing and 14 new protection rules.
Install from the Chrome Web Store
The extension is live at chromewebstore.google.com/de…. One click instead of unpacked-from-source. The prebuilt ZIP and source-build paths stay for Browserbase and other runtimes that need an unpacked extension.
New rules: handling prompt injection and context pollution in invisible surfaces
A browser-use agent reads surfaces a sighted user never looks at. The new rules close them:
- <noscript> blocks (never rendered with JS on, but agents walk them)
- Poisoned <meta> description and <title> (the compact "what is this page" answer many agents pull first)
- JSON-LD <script> blocks (cited as the "trusted summary" of a page)
- aria-label, alt, title, placeholder, and SVG <title> / <desc> / <text> (a11y-tree carriers)
- Unicode tag characters, bidi overrides, and zero-width payloads
- Long base64 / hex / percent-encoded blobs (the "decode this and follow it" pattern)
New rules: trust laundering
link-spoof-annotate flags Cyrillic homoglyphs and anchors whose visible text doesn't match the href apex. disguised-ad-flag collapses native advertorials (Sponsored / Paid Post) that share DOM shape with editorial. trust-badge-annotate and schema-trust-sanitize ship off by default while we assess their false-positive rates.
The daily-driver surprise
I've started running it on my own daily-driver browser, not just agent runs. There have been some funny quirks (e.g., flagging GitHub issue links with ".md" in the link text as suspicious and hiding the GitHub issue template modal). However, overall it's been a positive on my browsing experience. So, we'll be experimenting with making more annotations visible to humans and multi-modal LLMs.
Fan of fast and frugal heuristics? New blog post + interactive explorer on how Analysis of Competing Hypotheses (ACH) encodes Bayesian reasoning
toddschiller.com/blog/ach-ba…
Developers who dismiss coding copilot/agent performance forget that they themselves needed 3 months of "fine-tuning" to become productive on the code base
#AI #developers
✅The @ValDotTown guide for @pixiebrix just dropped
Run Vals or embed Val output from any web app
docs.pixiebrix.com/integrati…
Solved the #alignment problem ✅. We've been writing @geteslint rules in seconds with #ChatGPT
This one bans function names that rhyme with🍌
Thanks Alp for inviting me on the pod!
Our CEO @twschiller is on a cool podcast about the "Democratization of User Interface design" and NoCode tools!
Listen to the podcast below!
themasters.ai/episodes/inter…


