Add a section for private browsing to S&P considerations (#201)

SHA: fb1cc2c
Reason: push, by domfarolino

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: johannhof

index.html

@@ -5,10 +5,10 @@
   <title>WebMCP</title>
   <meta content="CG-DRAFT" name="w3c-status">
   <link href="https://www.w3.org/StyleSheets/TR/2021/cg-draft" rel="stylesheet">
-  <meta content="Bikeshed version e88ac908e, updated Thu Jun 4 14:22:36 2026 -0700" name="generator">
+  <meta content="Bikeshed version e74aa0952, updated Fri Jun 5 23:16:28 2026 +0000" name="generator">
   <link href="https://webmachinelearning.github.io/webmcp" rel="canonical">
   <link href="https://www.w3.org/2008/site/images/favicon.ico" rel="icon">
-  <meta content="4733c275a8c288b36eedef9fb4bbe7838e7e1a38" name="revision">
+  <meta content="fb1cc2c46a363e871dbf492b6cf0aa548f69b711" name="revision">
   <meta content="dark light" name="color-scheme">
   <link href="https://www.w3.org/StyleSheets/TR/2021/dark.css" media="(prefers-color-scheme: dark)" rel="stylesheet" type="text/css">
 <style>
@@ -841,7 +841,7 @@
 </p>
    <h1 class="no-ref p-name" id="title">WebMCP</h1>
    <p id="w3c-state"><a href="https://www.w3.org/standards/types/#CG-DRAFT">Draft Community Group Report</a>,
-    <time class="dt-updated" datetime="2026-06-05">5 June 2026</time></p>
+    <time class="dt-updated" datetime="2026-06-08">8 June 2026</time></p>
    <details open>
     <summary>More details about this document</summary>
     <div data-fill-with="spec-metadata">
@@ -941,6 +941,7 @@ <h2 class="no-num no-ref no-toc" id="contents">Table of Contents</h2>
           <li><a href="#privacy-implications"><span class="secno">6.3.3.3</span> <span class="content">Implications</span></a>
          </ol>
         <li><a href="#violation-same-origin-boundaries"><span class="secno">6.3.4</span> <span class="content">Violation of Same-Origin Boundaries</span></a>
+        <li><a href="#interaction-with-private-browsing"><span class="secno">6.3.5</span> <span class="content">Interaction with Private Browsing Modes</span></a>
        </ol>
       <li>
        <a href="#mitigations"><span class="secno">6.4</span> <span class="content">Mitigations</span></a>
@@ -1801,6 +1802,11 @@ <h4 class="heading settled" data-level="6.3.4" id="violation-same-origin-boundar
    <p class="XXX">
   TODO: Document risks and implications of <a data-link-type="dfn" href="#agent" id="ref-for-agent④④">agents</a> carrying state from one origin to another. Detail how tools executed on one origin may carry state from another origin, potentially leading to data leakage or same-origin policy bypasses if not handled securely by the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#user-agent" id="ref-for-user-agent⑧">user agent</a>. This section should probably talk about the WebMCP permissions policy and other cross-origin opt in mechanisms. 
 </p>
+   <h4 class="heading settled" data-level="6.3.5" id="interaction-with-private-browsing"><span class="secno">6.3.5. </span><span class="content">Interaction with Private Browsing Modes</span><a class="self-link" href="#interaction-with-private-browsing"></a></h4>
+   <p>Many user agents provide ephemeral, short-lived, <a href="https://w3ctag.github.io/private-browsing-modes/">private browsing modes</a> that are disconnected from a user’s primary profile, in that they do not share the same history or web-accessible storage.
+Users generally expect this boundary between regular and private browsing to be maintained and protected by the user agent. Exposing <a data-link-type="dfn" href="#agent" id="ref-for-agent④⑤">agents</a> to private browsing activity (e.g., by giving them access to WebMCP
+tools in private browsing) may inadvertently leak information across this boundary and lead to unauthorized joining or retention of private browsing data. Users agents are responsible for ensuring that their
+respective private browsing modes are safely exposed to <a data-link-type="dfn" href="#agent" id="ref-for-agent④⑥">agents</a> and that these agents have the ability to responsibly handle private browsing information.</p>
    <h3 class="heading settled" data-level="6.4" id="mitigations"><span class="secno">6.4. </span><span class="content">Mitigations</span><a class="self-link" href="#mitigations"></a></h3>
    <h4 class="heading settled" data-level="6.4.1" id="mitigation-restrict-input-lengths"><span class="secno">6.4.1. </span><span class="content">Restricting maximum input lengths</span><a class="self-link" href="#mitigation-restrict-input-lengths"></a></h4>
    <p><strong>What:</strong> Restrict the maximum amount of characters</p>
@@ -2386,7 +2392,7 @@ <h2 class="heading no-num no-ref settled" id="idl-index"><span class="content">I
 "a72449dd": {"dfnID":"a72449dd","dfnText":"in parallel","external":true,"refSections":[{"refs":[{"id":"ref-for-in-parallel"}],"title":"5.1. Event loop integration"}],"url":"https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel"},
 "a973e0fe": {"dfnID":"a973e0fe","dfnText":"document","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-document"}],"title":"5.1. Event loop integration"}],"url":"https://dom.spec.whatwg.org/#concept-document"},
 "ae2a6342": {"dfnID":"ae2a6342","dfnText":"top-level browsing context","external":true,"refSections":[{"refs":[{"id":"ref-for-top-level-browsing-context"}],"title":"5.2. Page observations"}],"url":"https://html.spec.whatwg.org/multipage/document-sequences.html#top-level-browsing-context"},
-"agent": {"dfnID":"agent","dfnText":"agent","external":false,"refSections":[{"refs":[{"id":"ref-for-agent"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-agent\u2460"}],"title":"2. Terminology"},{"refs":[{"id":"ref-for-agent\u2461"},{"id":"ref-for-agent\u2462"}],"title":"4.2. ModelContext Interface"},{"refs":[{"id":"ref-for-agent\u2463"},{"id":"ref-for-agent\u2464"},{"id":"ref-for-agent\u2465"},{"id":"ref-for-agent\u2466"},{"id":"ref-for-agent\u2467"},{"id":"ref-for-agent\u2468"}],"title":"4.2.1. ModelContextTool Dictionary"},{"refs":[{"id":"ref-for-agent\u2460\u24ea"}],"title":"4.2.3. ModelContextClient Interface"},{"refs":[{"id":"ref-for-agent\u2460\u2460"}],"title":"5.1. Event loop integration"},{"refs":[{"id":"ref-for-agent\u2460\u2461"}],"title":"5.2. Page observations"},{"refs":[{"id":"ref-for-agent\u2460\u2462"}],"title":"6. Security and Privacy Considerations"},{"refs":[{"id":"ref-for-agent\u2460\u2463"},{"id":"ref-for-agent\u2460\u2464"},{"id":"ref-for-agent\u2460\u2465"}],"title":"6.1. Approach to Risk Assessment and Mitigations"},{"refs":[{"id":"ref-for-agent\u2460\u2466"},{"id":"ref-for-agent\u2460\u2467"},{"id":"ref-for-agent\u2460\u2468"},{"id":"ref-for-agent\u2461\u24ea"},{"id":"ref-for-agent\u2461\u2460"}],"title":"6.2. Agent Baseline Capabilities"},{"refs":[{"id":"ref-for-agent\u2461\u2461"}],"title":"6.3.1. Prompt Injection Attacks"},{"refs":[{"id":"ref-for-agent\u2461\u2462"},{"id":"ref-for-agent\u2461\u2463"},{"id":"ref-for-agent\u2461\u2464"},{"id":"ref-for-agent\u2461\u2465"},{"id":"ref-for-agent\u2461\u2466"}],"title":"6.3.1.3. Tool Implementation as Attack Targets"},{"refs":[{"id":"ref-for-agent\u2461\u2467"}],"title":"6.3.2. Misrepresentation of Intent"},{"refs":[{"id":"ref-for-agent\u2461\u2468"}],"title":"6.3.2.1. Why This Matters"},{"refs":[{"id":"ref-for-agent\u2462\u24ea"},{"id":"ref-for-agent\u2462\u2460"},{"id":"ref-for-agent\u2462\u2461"},{"id":"ref-for-agent\u2462\u2462"}],"title":"6.3.2.2. Misalignment Types"},{"refs":[{"id":"ref-for-agent\u2462\u2463"},{"id":"ref-for-agent\u2462\u2464"}],"title":"6.3.2.3. Scenario: Ambiguous Finalization (Accidental or Malicious)"},{"refs":[{"id":"ref-for-agent\u2462\u2465"}],"title":"6.3.2.4. Current Gaps"},{"refs":[{"id":"ref-for-agent\u2462\u2466"}],"title":"6.3.3. Privacy Leakage Through Over-Parameterization"},{"refs":[{"id":"ref-for-agent\u2462\u2467"},{"id":"ref-for-agent\u2462\u2468"}],"title":"6.3.3.1. The Privacy Risk"},{"refs":[{"id":"ref-for-agent\u2463\u24ea"},{"id":"ref-for-agent\u2463\u2460"},{"id":"ref-for-agent\u2463\u2461"}],"title":"6.3.3.2. Example Attack"},{"refs":[{"id":"ref-for-agent\u2463\u2462"}],"title":"6.3.3.3. Implications"},{"refs":[{"id":"ref-for-agent\u2463\u2463"}],"title":"6.3.4. Violation of Same-Origin Boundaries"}],"url":"#agent"},
+"agent": {"dfnID":"agent","dfnText":"agent","external":false,"refSections":[{"refs":[{"id":"ref-for-agent"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-agent\u2460"}],"title":"2. Terminology"},{"refs":[{"id":"ref-for-agent\u2461"},{"id":"ref-for-agent\u2462"}],"title":"4.2. ModelContext Interface"},{"refs":[{"id":"ref-for-agent\u2463"},{"id":"ref-for-agent\u2464"},{"id":"ref-for-agent\u2465"},{"id":"ref-for-agent\u2466"},{"id":"ref-for-agent\u2467"},{"id":"ref-for-agent\u2468"}],"title":"4.2.1. ModelContextTool Dictionary"},{"refs":[{"id":"ref-for-agent\u2460\u24ea"}],"title":"4.2.3. ModelContextClient Interface"},{"refs":[{"id":"ref-for-agent\u2460\u2460"}],"title":"5.1. Event loop integration"},{"refs":[{"id":"ref-for-agent\u2460\u2461"}],"title":"5.2. Page observations"},{"refs":[{"id":"ref-for-agent\u2460\u2462"}],"title":"6. Security and Privacy Considerations"},{"refs":[{"id":"ref-for-agent\u2460\u2463"},{"id":"ref-for-agent\u2460\u2464"},{"id":"ref-for-agent\u2460\u2465"}],"title":"6.1. Approach to Risk Assessment and Mitigations"},{"refs":[{"id":"ref-for-agent\u2460\u2466"},{"id":"ref-for-agent\u2460\u2467"},{"id":"ref-for-agent\u2460\u2468"},{"id":"ref-for-agent\u2461\u24ea"},{"id":"ref-for-agent\u2461\u2460"}],"title":"6.2. Agent Baseline Capabilities"},{"refs":[{"id":"ref-for-agent\u2461\u2461"}],"title":"6.3.1. Prompt Injection Attacks"},{"refs":[{"id":"ref-for-agent\u2461\u2462"},{"id":"ref-for-agent\u2461\u2463"},{"id":"ref-for-agent\u2461\u2464"},{"id":"ref-for-agent\u2461\u2465"},{"id":"ref-for-agent\u2461\u2466"}],"title":"6.3.1.3. Tool Implementation as Attack Targets"},{"refs":[{"id":"ref-for-agent\u2461\u2467"}],"title":"6.3.2. Misrepresentation of Intent"},{"refs":[{"id":"ref-for-agent\u2461\u2468"}],"title":"6.3.2.1. Why This Matters"},{"refs":[{"id":"ref-for-agent\u2462\u24ea"},{"id":"ref-for-agent\u2462\u2460"},{"id":"ref-for-agent\u2462\u2461"},{"id":"ref-for-agent\u2462\u2462"}],"title":"6.3.2.2. Misalignment Types"},{"refs":[{"id":"ref-for-agent\u2462\u2463"},{"id":"ref-for-agent\u2462\u2464"}],"title":"6.3.2.3. Scenario: Ambiguous Finalization (Accidental or Malicious)"},{"refs":[{"id":"ref-for-agent\u2462\u2465"}],"title":"6.3.2.4. Current Gaps"},{"refs":[{"id":"ref-for-agent\u2462\u2466"}],"title":"6.3.3. Privacy Leakage Through Over-Parameterization"},{"refs":[{"id":"ref-for-agent\u2462\u2467"},{"id":"ref-for-agent\u2462\u2468"}],"title":"6.3.3.1. The Privacy Risk"},{"refs":[{"id":"ref-for-agent\u2463\u24ea"},{"id":"ref-for-agent\u2463\u2460"},{"id":"ref-for-agent\u2463\u2461"}],"title":"6.3.3.2. Example Attack"},{"refs":[{"id":"ref-for-agent\u2463\u2462"}],"title":"6.3.3.3. Implications"},{"refs":[{"id":"ref-for-agent\u2463\u2463"}],"title":"6.3.4. Violation of Same-Origin Boundaries"},{"refs":[{"id":"ref-for-agent\u2463\u2464"},{"id":"ref-for-agent\u2463\u2465"}],"title":"6.3.5. Interaction with Private Browsing Modes"}],"url":"#agent"},
 "ai-agent-queue": {"dfnID":"ai-agent-queue","dfnText":"AI agent queue","external":false,"refSections":[{"refs":[{"id":"ref-for-ai-agent-queue"},{"id":"ref-for-ai-agent-queue\u2460"}],"title":"5.2. Page observations"}],"url":"#ai-agent-queue"},
 "ai-platform": {"dfnID":"ai-platform","dfnText":"AI platform","external":false,"refSections":[{"refs":[{"id":"ref-for-ai-platform"}],"title":"2. Terminology"}],"url":"#ai-platform"},
 "b0d7f3c3": {"dfnID":"b0d7f3c3","dfnText":"USVString","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-USVString"}],"title":"4.2.1. ModelContextTool Dictionary"},{"refs":[{"id":"ref-for-idl-USVString\u2460"}],"title":"4.2.2. ModelContextRegisterToolOptions Dictionary"}],"url":"https://webidl.spec.whatwg.org/#idl-USVString"},