12 ms·

Mozilla's opposition to Chrome's Prompt API

• shevy-java 5mo ago
  > This will result in Mozilla and Apple having to licence Google's model, or ship a model that's quirks-compatible with the Google model in order to be interoperable. It may also become difficult for Chrome to update its own model for the same reasons. Google is again doing Evil. I am very annoyed that Google kind of de-facto controls the www (through chrome, let's be honest here). We really need to change this. I don't have a good solution here, but it can not continue that way.
  • youre-wrong3 5mo ago
    Only have yourselves to blame. Chrome made the internet better but everyone put their fingers in their ears about it getting worse at the same time.
    • hk__2 5mo ago
      Both, actually. It did make some parts of the Internet better, and some other worse.
    • darkwater 5mo ago
      Which Internet did make better?
      • bilekas 5mo ago
        For anyone working in the web area during the old IE days will know, not having to have a dedicated css and js for each browser type was a gamechanger. Chrome's introduction, albeit through smoother, lighter browser experience at the time, pushed other browsers to standardize to google. In one way it's bad to have a homogenous approach to all things web based, but in another way it did make the internet a better experience overall.
        • dannyw 5mo ago
          In the horror days of IE, I remember having to look up some DirectX filter to properly display PNG images with transparency. It was that bad, and that’s one example of 1000. Some libraries/scripts helped normalise things a little, but never enough. Yuck.
      • deleted 5mo ago
        [deleted]
      • izacus 5mo ago
        The one you're using every day filled with web apps that runsl securely without you dowloading sketchy binaries or being locked into walled garden app stores.
        • darkwater 5mo ago
          It's also the one where I find sites where I can't even login if I'm using Firefox. i.e. my bank just redesigned their website and now you can login only with Chrome. For some weird bug, Firefox isn't allowed. The same exact issues we had with IE.
      • dannyw 5mo ago
        You remember the IE days right? Being a web developer was not fun; and the web was absolutely being held back. Chrome did a lot of things right: per-origin sandboxing, properly implementing web standards, V8, developer tools, and back then Chromium was super close to Chrome. Do I think Chrome is a net-negative for the web over the past ~3-5 years? Yes, especially with manifest v3, “privacy sandbox”, and them basically forcing through web APIs because they have the dominant marketshare. But early Chrome was a technologically impressive and user-friendly browser that really did make the web massively better. I remember happily putting Firefox and Chrome mini-banners (what are they called? Those little rectangular images) on my website, for free, because I recommended it.
        • Izkata 5mo ago
          Developer tools, at least, came through Firefox with Firebug, years before Chrome/Chromium existed.
    • halJordan 5mo ago
      It was hard to stomach the "I looove Chrome. It can do no wrong" but these "Why did we let google control everything" comments are even worse
  • thrance 5mo ago
    Lina Khan's FTC sought to break Google into multiple companies, leaving Chrome alone. Alas, Google escaped unscathed.
    • rerdavies 5mo ago
      Fortunately, they chickened out when they realized that forcing Google to divest Chrome would result in Chrome being owned by Perplexity (an Indian AI company). Or perhaps somebody even worse, like Elon Musk.
    • a1o 5mo ago
      I am curious if such thing happened, how would Chrome sustain itself as a company. I imagine Google would pay a hefty contract to it and keep their control, or some other actor would do and change the actors in the problem, but keeping it.
  • motbus3 5mo ago
    Chrome is not that good anymore compared to other browsers. I switched long time ago and if the doesn't work with basic features I just leave the site out instead of letting it use chrome to control me
  • jraph 5mo ago
    > We really need to change this. I don't have a good solution here, but it can not continue that way. Advocacy (against chromium and its forks) is one way.
• croes 5mo ago
  So the next anti trust case for the EU. Chrome is clearly dominating the browser market and now they try to abuse that (again)
  • jauntywundrkind 5mo ago
    It's exhausting having such reflexive thoughtless ragging anytime Chrome is mentioned. Oh no! Chrome is trying to enhance user agency again! Oh no! Chrome is trying to make the web better for end users! Mozilla's concerns aren't totally bogus, I'm not going to try to laugh them out of the room. But their pearl clutching & belly-aching about "oh no what if not all implementations of ai prompts work exactly the same" feels fucking tired and weak sauce to me. This post really doesn't deserve our attention, my my view. But I'd challenge the haters to at least try to connect their reflexive hate meaningfully to what the topic at hand actually is, to provide something worth considering in some way. But that I think asks too much, for what posts like this seek: merely to inflame the world.
    • croes 5mo ago
      Oh no, Chrome is adding something that shouldn't be in the browser in the first place. Oh no, Chrome is adding Googles own AI as only possibilty what surely doesn't hinder competition. Maybe you shouldn't reflexivly defend Chrome when they clearly abuse their market leading position to push their own AI.
    • orphea 5mo ago
      Can you please explain how the hell AI slop is going to "enhance user agency" or "make the web better"?
    • 8NNTt8z3QvLT8tp 5mo ago
      It's not pearl clutching to suggest that websites will build around quirks of a specific model and then we'll be stuck with it forever. This is an issue for future Google as much as it is for Mozilla and Apple. We had WebSQL which defactor relied on a specific DB implementation, sqlite, and I suspect it also essentially couldn't be updated because people relied on the quirks of a specific version of sqlite.
• varun_ch 5mo ago
  I wonder if it makes sense for browser vendors to agree upon and ship various ‘standard models’ that are released into the public domain or something, and the API lets you pick between them. The models themselves would be standardized and the weights and everything should be identical between browsers. They’d be standard and ‘web-safe’ like CSS colors or fonts. Probably would help to give them really boring/unbranded names too. These would work identically across browsers and web developers can rely on them existing on modern setups. If you want more models, you could install them as a user or your browser could ship them or the web developers could bundle them through a CDN (and another standard for shared big files across domains would probably be needed)
  • jaffathecake 5mo ago
    The rate of model development is an issue here. Once there are many cross-origin models, it becomes a fingerprinting vector. Also even the small models are many GBs.
  • austin-cheney 5mo ago
    Browsers do not need to force LLMs on their users.
  • fg137 5mo ago
    It doesn't make sense at all. So as a user how do you choose which model to use? There could be 3824 models to choose from. The browser might as well set one as default, and we all know how that goes (see: search engine). Not to mention many other UX questions the come with this, most importantly, how unusable these local models are on regular 3-year old laptops that are constrained in RAM, GPU/CPU capability and likely disk space despite what enthusiasts say here. (They have a Macbook Pro with 32+GB of RAM, reports it works great with xyz model -- fine -- but somehow thinks it works for everyone and local models are the future.)
    • jaffathecake 5mo ago
      The Chrome model requires either "16 GB of RAM or more and 4 CPU cores or more" or "Strictly more than 4 GB of VRAM", and "22 GB of free space" (it uses around 4.4GB but it doesn't want to use the remaining free space). The model is pretty slow on my M4 Pro mac. The API allows the browser to use a cloud service instead, but then privacy is lower. So, more privacy for the rich.
• benterix 5mo ago
  > Browsers and operating systems are increasingly expected to gain access to language models.[0] Are they? [0] https://github.com/webmachinelearning/prompt-api/blob/main/README.md https://github.com/webmachinelearning/prompt-api/blob/main/R...
  • raincole 5mo ago
    Browsers: Chrome (proposed this Prompt API) Operating Systems: Windows (built-in Copilot), MacOS, iOS (Apple Intelligence) So it's >90% desktop browser and OS, plus >30% mobile OS. Yes, I think it's very safe to say "browsers and operating systems are increasingly expected to gain access to language models."
    • benterix 5mo ago
      The word "expected" is a weasel word in this context, especially given how muck backlash MS has received. I'd expect a link to a study where users say: "I'd like to have an LLM integrated with my operating system and my browser" and how it changes over time. Then you can seriously argue for "increasingly expected".
    • bakugo 5mo ago
      What this proves is that browsers and operating systems are increasingly integrating language models, not that they are expected to do so. The only people who expect them to do so are big tech executives. The average user does not expect nor want Copilot shoved into every possible corner of Windows, and Microsoft themselves have acknowledged this.
    • deaux 5mo ago
      You omitted the clause "by shareholders" after "expected".
    • kirb 5mo ago
      These features are enabled by default, and in the case of iOS/macOS, desktop Chrome, probably also Copilot+ PCs, download 4 - 7 GB local models without properly explaining this to users. This doesn’t confirm any demand because if you just don’t use the features and don’t fill up your device, you may never notice. I think this API is probably fine, but only if the user already has a model downloaded and wants these features. Naturally, case in point, Chrome quietly downloads Gemini Nano without any opt-out except through group policy. Things like this and Microsoft’s recent admission that they’ve overindexed on Copilot features in Windows make it increasingly difficult to trust that users actually want more than a few killer AI features, most of which are just ChatGPT. Anecdotally, non-technical friends and family members know about ChatGPT and increasingly Gemini, get frustrated by Copilot, and don’t know Apple Intelligence exists. https://superuser.com/questions/1930445/can-i-delete-the-chromes-optguideondevicemodel-safely-its-taking-up-4gb https://superuser.com/questions/1930445/can-i-delete-the-chr...
• fg137 5mo ago
  If every browser vendor already has their experimental APIs that can work with different models, it might be a good idea to standardize this in WhatWG living standards (which would still be bad user experience on today's consumer hardware) But if no browser other than Chrome supports this, and only Google's (proprietary) model (edit: plus Microsoft's Phi-4 mini in Edge), it should be clear it's Google abusing its position. There is nothing worth standardizing. And we have seen that too many times -- FLoC/Privacy Sandbox/Topics API, Web Environment Integrity just to name a few. Google has been relentless in using its dominant position to push terrible ideas that harm both users and other browser vendors but help only Google's business. Surprised this did not really come up in previous discussion in https://news.ycombinator.com/item?id=47917026 https://news.ycombinator.com/item?id=47917026 PS: looks like Google's fanboys have arrived. Someone better finds good counterarguments, especially technical ones, instead of just downvoting.
• OuterVale 5mo ago
  Extremely glad to see Mozilla taking a stance here.
  • alex_duf 5mo ago
    28th of april 2025, isn't this before mozilla added lots of AI feature in their browser?
    • jaffathecake 5mo ago
      Sigh, when I posted this, I linked to https://github.com/mozilla/standards-positions/issues/1213#issuecomment-4347988313 https://github.com/mozilla/standards-positions/issues/1213#i... (which was posted 11 hours ago). Unfortunately someone changed the link.
    • Vinnl 5mo ago
      This is the specific position posted today/yesterday: https://github.com/mozilla/standards-positions/issues/1213#issuecomment-4347988313 https://github.com/mozilla/standards-positions/issues/1213#i...
    • nicman23 5mo ago
      features that are opt in are ok. anti features that are opt out is not ok
    • madeofpalk 5mo ago
      The objection is not anti-AI. It’s anti this specific API, for nuanced web compatibility reasons.
  • ilaksh 5mo ago
    Archibald is anti-AI. 70+% of his public statements have demonstrated that. He is more or less aligned with the current most common sentiment in the west which is largely publicly against AI. But realistically it's just slow adaptation, network effects, etc. To give an example, before the MLB rolled out the Automated Ball Strike system this year, last year maybe 65+% of the sentiment in discussions about it was negative or in some cases just neutral. Now that it has rolled out, 95% of the sentiment online about ABS is positive. The main comment by far is, why didn't they do this before, and why don't they do it automatically on all pitches now. There are certain cognitive and informational flow limitations in society that will cause this to be delayed, just like all major technological advancements. But once it rolls out, the perspective you hear online will be about digital sovereignty/personal data autonomy, now we aren't required to send our data to an external provider for AI, why wasn't this available before. People will probably assume it was blocked because it reduced a major source of data for advertising or something. And overall AI and robotics in the future will be seen as the greatest enabling factor for increased equality in society. It's really just this underlying dislike of and disrespect for technology that much of the western public has. Which may turn out to be one of the reasons that we lose our de facto leadership position in the world.
• jaffathecake 5mo ago
  When I posted this, I linked to the latest statement https://github.com/mozilla/standards-positions/issues/1213#issuecomment-4347988313 https://github.com/mozilla/standards-positions/issues/1213#i..., which is the content relevant to the title (the details of our opposition to the API). Unfortunately someone removed the link to the specific post.
  • dang 5mo ago
    The "someone" was HN's software but I agree it was a mistake in this case. Sorry! Fixed above now.
• swyx 5mo ago
  ^ didnt realize who posted the opposition - this is Jake Archibald, a longtime googler on the Chrome team, now joining Mozilla and posting opposition to the Chrome API. no wonder the criticism is so well argued. most be a relief to not have to toe the party line on this one.
  • jaffathecake 5mo ago
    Aww thanks! To be fair I didn't toe the party line when I was at Google (imo). Although, that caused me increasing amount of grief internally, until I left. From what I hear, things have gotten exponentially worse in that regard for folks still on the team.
    • tuesdaynight 5mo ago
      Hey, Jake, not related with your post, but I just want to say that HTTP203 were one of the best web dev content that I've ever consumed. Amazing mix between humour and tech discussion. Thank you!
      • jaffathecake 5mo ago
        Aww thanks for saying that! I've been doing little videos on https://www.youtube.com/@FirefoxWebDevs https://www.youtube.com/@FirefoxWebDevs (and accounts of the same name, pretty much everywhere). Although they're designed to be short, so they're pretty different to HTTP203.
        • Xunjin 5mo ago
          This channel should definitely get more visibility ;)
      • swyx 5mo ago
        co sign, tuning in to you and Das riffing was one of the highlights of my webdev career. bring it back!! (lmk if you'd like an ai.engineer stage to do it on)
    • 5mo ago
• austin-cheney 5mo ago
  I wonder if this is a generational thing of fresh young people that already cannot live without LLMs versus crusty old people that don’t want to require a super computer just to run a web browser that violates all their privacy. To me this sounds like the point where people start looking at and developing alternatives to the browser/web.
  • tomashubelbauer 5mo ago
    IME young people mostly hate AI.
    • kilroy123 5mo ago
      The young kids I know who are into tech love AI. Albeit this is from a small sample size.
      • DaSHacka 5mo ago
        Funnily enough, most of the young people I know fall somewhere between those two sides of the spectrum. I know some actual luddite-tier AI haters that believe it's ontologically evil, and another majoring in Data Science that went to the most recent career fair and told a recruiter "AI will replace you" (I uh don't think he's getting that internship) And of course many, many, others that fall between the two extremes. The one thing we can all agree on, is it makes homework a hell of a lot easier :) (well, except the luddite-types, they refuse to use it in any capacity)
        • whatisthiseven 5mo ago
          The biggest irony with telling a recruiter they'll be replaced, is how much easier a data scientist is to replace with LLMs. With their sycophantic nature, execs will eat up whatever "data" the LLMs make up, too.
          • mbbutler 5mo ago
• aegiswizard 5mo ago
  [flagged]
• Wowfunhappy 5mo ago
  > According to Chrome's documentation, to use the prompt API you must 'acknowledge' Google's Generative AI Prohibited Uses Policy. Elements of this policy go beyond law. For example: >> Do not engage … generating or distributing content that facilitates … Sexually explicit content Do not engage in misinformation, misrepresentation, or misleading activities. This includes … Facilitating misleading claims related to governmental or democratic processes > This seems like a bad direction for an API on the web platform, and sets a worrying precedent for more APIs that have UA-specific rules around usage. I will say this more strongly—I think it is completely insane, and a violation of free expression principles, for a browser API to have content restrictions.
  • jaffathecake 5mo ago
    Agreed. Maybe Google will propose a CSS text formatting property that cannot be used on paragraphs that are critical of the US administration. Like, that sounds daft, but it's not really far from what they're doing here.
  • tuesdaynight 5mo ago
    Why is Google doing this? They would need to moderate the use of the API, right? What they could gain having to moderate use of a browser's API?
    • LauraMedia 5mo ago
      A blank cheque to restrict access to any website they want.
  • anthonyrstevens 5mo ago
    Possibly truth is a higher societal good than unfettered free expression? Reasonable people may debate that concept. Ref: X
• hmokiguess 5mo ago
  The nice thing about open protocols is that we don't have to endorse or use one implementation over another, yet, somehow, the browser monopoly continues to be a standing dilemma. There are nice projects, like ungoogled chromium, tor, and many more, but I find the biggest issue is that there isn't a voice out there for the average person and a project that connects with the masses. I think another issue is that a lot of the uninformed users have a strong apathy for the causes and ways the message is delivered, they rather engage and connect with things that are "fun" and want less friction rather than freedom and control. How do we solve this? How do we make the browser ours, by the people, and for the people? Sorry, I'm just sad whenever I think of this.
  • matheusmoreira 5mo ago
    > How do we solve this? How do we make the browser ours, by the people, and for the people? Simple. Break up all the big tech corporations via anti-trust legislation. They are the robber barons of our time.
    • deleted 5mo ago
      [deleted]
    • deleted 5mo ago
      [deleted]
  • jedimastert 5mo ago
    > How do we solve this? How do we make the browser ours, by the people, and for the people? Unfortunately, the answer is pretty much always "real public funding"
  • Joe_Cool 5mo ago
    It's somehow even worse when you compile your own browser. Want Spotify or Netflix? You need Widevine with attestation. Go pay Google. Your Browser Agent string isn't Chrome or Firefox? Enjoy endless Cloudflare captchas or just a 403 error.
    • 5mo ago
• wg0 5mo ago
  This seems like that infamous <marquee> tag [0] to me that felt good and amazing at the time but later turned out not to be a good idea. [0]. https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/marquee https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/...
  • riffraff 5mo ago
    did the marquee prove to be a bad idea? I think it was subsumed by later developments (javascript), but the issue with it AFAIR was just that it wasn't useable in all browsers, not that the tag per se was a bad idea (as much as scrolling text can be). The situation with the model api seems different, more like the AMP spec.
• heresie-dabord 5mo ago
  The objections seem clear: tight-coupling of prompts to models, and model neutrality in the TOU. From https://github.com/mozilla/standards-positions/issues/1213 https://github.com/mozilla/standards-positions/issues/1213 : "A personal example: I created a system prompt for creating announcements for a home automation system. The Gemini model I was using initially responded in a very US-American way, which didn't fit the British voice of my speaker. I told the model, via the system prompt, that the output was being spoken in a British voice, but the result was a bad US-American impersonation of British ("a'waight guv'nor apples and pears" etc etc), so I had to iterate further to 'tone it down' and speak actual British. In this process, the system prompt becomes tailored to the model. Other models will have different quirks. Things added to the system prompt for one model may be an overcorrection for another."
  • ilaksh 5mo ago
    If that was a good argument to not support an LLM feature, then it would be a reason to not add it to any platform API. And yet, it has been added to numerous platforms already. Different models are just a core aspect of how the technology works. It's like a canvas can have different possible width and height depending on the device or it's orientation. Or the geolocation API giving more or less accuracy depending on the device. Or Speech Synthesis sounding different depending on the device. This is really just anti-AI sentiment rather than being constructive. For now, it needs a permissions UI if it doesn't already have one. And maybe at some point they will add a n IQ level like low, medium, high or something. But developers are going to rely on the specific model 90% of the time anyway if they care about it. What's going to change is really just that the AI hatred will die down some as people realize how much it helps them, and people will realize not having this feature in Firefox is a failure for personal data autonomy. And the TOU that are related in Chrome being problematic is an argument FOR Firefox to add this feature, without problematic model terms.
    • foolswisdom 5mo ago
      The important part was the following paragraph(s) that explained why this coupling is a compelling problem. It's not the same as just having a platform API.
• moron4hire 5mo ago
  Web API features should be things that are necessary to enable features in Web applications. We don't need the browser to have a Prompt API to enable web applications to have goofy chatbots lurking in the corner. WebDevs are perfectly capable of ruining their websites on their own.
• the42thdoctor 5mo ago
  This reminds me of the speech to text API, which already uses AI and is available on almost all browsers. So there's already precedent. But most importantly this would enable us to finally write JavaScript like this: const a = prompt("how much is 31c in Fahrenheit") The future looks bright!
  • LauraMedia 5mo ago
    I know you're probably joking, but I was curious how hard it would be. const cToF = c => c * 9/5 + 32; const a = cToF(31);
• AntiUSAbah 5mo ago
  I find this a weird discussion at the current point. Shouldn't be there a basic process for allowing such an API as a alpha people can play around with and then there will be adjustments? No one will start using this in production if they don't have a very good and specific use case. I mean you don't just run 2gb ML models in your browser today on a massive scale.
  • domenicd 5mo ago
    (Former Chrome team member who worked on this API, now retired.) There was such a process! They shipped as first Dev Trial around 2025-04, then Origin Trial in 2025-05. Since then a number of people tried it and gave lots of feedback, leading to model quality improvements, language support expansion, API additions like structured responses and tool use, etc. You can find a lot of feedback and case studies if you search around.
• economistbob 5mo ago
  That discussion has a quote about querying the LLM for version information. If the models hallucinate/make up court citations, work and facts, what makes them believe that the model provided a genuine version number as opposed to an generatively constructed string?
  • jedimastert 5mo ago
    Would it even be possible for a model to know its own version number? I guess maybe if they decide to put it in the system prompt or something
  • jaffathecake 5mo ago
    Yes! It might lie or hallucinate. But also, all browsers claim to be "Mozilla/5.0" in their user agent string. It's a very similar problem.
• Havoc 5mo ago
  Alas we’re in a lovely near monoculture once again.
• righthand 5mo ago
  So we can’t have XSLT fast and efficient templating syntax but Prompt APIs with potential attack injection vectors are cool as long as they’re generic enough for all megacorps to drop in? No security risks here huh? Not trying to increase the attack surface huh?
  • vehemenz 5mo ago
    Don't forget MathML and all the other features they gave up on
• xnx 5mo ago
  Is this going to be another situation, like WebSQL, where Firefox torpedos a broadly useful feature?
  • LauraMedia 5mo ago
    I think every aspect within their opposition is sound and generally to keep the web open and predictable (unlike other oppositions like the Filesystem API).
• ilaksh 5mo ago
  The Prompt API has some advantages like being a little simpler for some things and some potential to standardize a little bit more in some way, but it looks like from this that it will be delayed unfortunately. However, WebLLM (a library, not actual Web API) https://github.com/mlc-ai/web-llm https://github.com/mlc-ai/web-llm is more capable and will already work using WebGPU.
• domenicd 5mo ago
  I was formerly the design lead / spec editor for this API while I worked at Google. I retired in 2025-09, before it got shipped. The following contains no inside knowledge. I am sympathetic to all of Mozilla's concerns here, even though on balance I believe Chromium's decision to ship was the right one. --- On interoperability, I agree that this is a tough case. But I am more optimistic than Mozilla that developers will use this API in a way that can work across different models. First, they will be somewhat forced to, because Chrome will change the model over time. (It already changed from Gemini Nano 2 to 3, and I suspect it'll change to 4 soon if it hasn't already.) Edge is already shipping a Phi-based version. A small number of users are using other models via extensions like https://aibrow.ai/ https://aibrow.ai/. And it's very possible Safari might join the party, exposing the Apple Foundation Models that ship with iOS via this API. (When the Foundation Models API came out, we were struck by how similar it was to the prompt API designs that preceded it, and were hopeful that Apple was going to do a surprise announcement of shipping the prompt API. It hasn't happened yet, but I still think it might soon.) Second, we designed the API to steer developers in that direction as much as possible, e.g. encouraging the use of structured output constraints. There are also lots of clear error paths, that almost force developers to use this as a progressive enhancement. (E.g., the existence of low-memory/disk space devices.) So it's very unlikely we'll see developers build sites that are gated on this API existing. It'll mostly be used to sprinkle some AI magic, or let users do cool things without entering some cloud API keys. I made similar arguments for the writing assistance APIs at [1]. As I said there, the prompt AI is trickier than the writing assistance APIs. But I believe it's a difference of degree, not kind. The web has many nondeterministic APIs that access some underlying part of the system, from geolocation to speech recognition/synthesis, all the way up to these AI-based ones. The question is where you draw the line. Mozilla seems to be giving some signals (not yet definite) that translation is on the OK side of the line, but summarization/writing/rewriting/prompting is not. That's a very reasonable position for them to take on behalf of their users. I imagine the Chromium project is hoping that over time, in-the-wild experience with these APIs shows that the benefits outweigh the risks and costs, and so Mozilla (and Apple) follow in shipping them as well. That's definitely happened in other cases, e.g., Mozilla recently indicating interest [2] in implementing WebBluetooth, WebHID, WebNFC, WebSerial, and WebUSB after years of taking a wait-and-see attitude. You can learn more about my general thoughts on this question of shipping APIs first, and how the Chromium project takes on first-mover risks, at [3], which I wrote during my time on the Chrome team. --- On the prohibited use policy, I agree that this is just absurd on Chrome's part. This is not how web APIs should work. It smacks of lawyers trying to throw something out there to cover themselves, or of corporate policy being set at the top level for "all AI uses" and then applied even for web APIs where that makes less sense. The only saving grace is that I suspect it won't actually trigger. Because, as Mozilla points out, it's quite impractical to enforce. But it's still wrong. I hope Chrome changes this, although I'm not holding my breath. I did find it interesting that Gemma seems to have a similar terms of use [4]. (Open-weights, not open-source!) As do the Apple Foundation Models in iOS [5]. So unfortunately if the Chrome team were to push for a no-TOS API, they might be forging new ground, which is always difficult in a large company. --- On the issue of insubstantial developer signals, I think this is just a failure of the current Chrome team in terms of collecting and collating signals. If one pokes around and knows where to look in various threads, you can find a lot more positive signals than the outdated ones in [6]. I wouldn't have let that Intent to Ship get out the door without properly updating that section of the explainer, for sure. (But hey, not my job anymore!!) [1]: https://github.com/mozilla/standards-positions/issues/1067#issuecomment-2921239314 https://github.com/mozilla/standards-positions/issues/1067#i... [2]: https://github.com/whatwg/sg/pull/264 https://github.com/whatwg/sg/pull/264 [3]: https://www.chromium.org/blink/guidelines/web-platform-changes-guidelines/ https://www.chromium.org/blink/guidelines/web-platform-chang... [4]: https://ai.google.dev/gemma/terms https://ai.google.dev/gemma/terms [5]: https://developer.apple.com/apple-intelligence/acceptable-use-requirements-for-the-foundation-models-framework/ https://developer.apple.com/apple-intelligence/acceptable-us... [6]: https://github.com/webmachinelearning/prompt-api/blob/main/README.md#stakeholder-feedback https://github.com/webmachinelearning/prompt-api/blob/main/R...
• pbronez 5mo ago
  I’m kinda terrified by the security implications of the Prompt API. This is a way for web services to make your computer complete large amounts of compute at their behest. Tokens have value. There will be incentive for bad actors to use your local LLM for their own purposes, much like hostile crypto mining payloads. This is an obvious target for prompt injection attacks and other malicious remote code execution. In many ways, model prompts ARE programs. The browser / local device would need to provide an LLM with the same sandbox guarantees as the rest of the browser. Can they be trusted to do that? Does anyone understand this well enough to do that with confidence? I’m a big fan of local models, but I would be very cautious about letting random websites call the model I’m hosting on my local machine with open source software.
  • tln 5mo ago
    > Does anyone understand this well enough to do that with confidence? Pretty sure Chrome wouldn't ship if they weren't confident. And Firefox would object based on security grounds if they saw such an issue
  • LauraMedia 5mo ago
    Yeah I wonder, who says I can't build a "cryptominer like" script that injects into many websites and just uses this local LLM api, performs a request from a queue and sends the response to a server, practically creating my very own LLM botnet?
• codedokode 5mo ago
  I am against this. 1) This will be a new source of fingerprinting information and this is difficult to fake to fool fingerprinting scripts, so it can be abused for "device verification". There should be no ability to "verify" a browser, and anyone should be able to emulate any browser. This is the most important point, I thought Google people are smart enough to see it. 2) LLMs use lot of memory and CPU time, for many users they would slow down their system significantly, and given current RAM prices, upgrades are very expensive. If the website relies on local model, it would work slow on cheap devices. 3) The API seems to be tailored for specific LLM like OpenAI. 4) This can be used to push competitors who do not have an AI model from the browser market - the sites would break because they will be made with expectation of having Google Gemini model and would not work with other models. For example, the sites would break in national browsers not having an AI model. There should be no "first-class" and "second-class" browsers. The explainer claims that this would allow the user to process the data locally without sending it anywhere. But why does Google Gemini local model have "Prohobited Use Policy" then? Why should they bother about prompts and responses they never learn about? While offline LLM access seems like a good idea, the website could use WebGPU for this without building LLM into the browser (or they could improve WebGPU for better handling ML models). Or everyone should use the same, open source, LLM.
  • MisterTea 5mo ago
    > This is the most important point, I thought Google people are smart enough to see it. Google just points towards the money like other bacterium and beats its flagella until it gets there. I don't know why or how anyone would EVER think Google is going to do something good for the web or humanity.
    • john_strinlai 5mo ago
      >I don't know why or how anyone would EVER think Google is going to do something good for the web or humanity. i dislike google as much as the next guy, but sometimes it can be good to remember that actual humans work at google. some of them want to improve things for people. some of them even have a conscience. one immediate "good" that comes to mind, from google, is the project zero team.
• 827a 5mo ago
  The more I think about it, the more I think I align with Google's API design on this one. The tight coupling between prompts and models is a real concern. I deal with that every day. However: if your solution to that is to support an API that enables tighter coupling between the model the user's browser has and the prompt that gets evaluated, you will inevitably and quickly enter the domain of "You need to use Chrome to use this site (because our prompts were only tested on Gemini)" or even worse "We don't recognize the AI model you're using (because the website was written in 2026 and the current year is 2030 and they never updated it)". This is related to the terms of use concerns the Mozilla engineer has later; real concerns. But, if we want browsers to exist that don't require users to opt-in to the terms of use of a specific AI model (e.g. using a nice open source model), its beneficial to these browsers that they can't fingerprint for the Big Models. Of course many sites will just do an isChrome()-like call anyway. Nothing to be done about that. But yeah I am generally non-supportive of changes that introduce more ways to fingerprint browsers. The upside of keeping the model anonymous outweighs the slight downside of (rarely) encountering weird prompt evaluation output because of a small difference in behavior between Gemini and, idk, Qwen.
• kmeisthax 5mo ago
  My personal opinion is that if we are going to have any amount of AI capability in the browser, it should be something very low-level, akin to WebGPU. Ideally, it would work similarly to Apple's Accelerate framework, where your requests are just routed to whatever AI accelerator the device thinks makes sense, so that we can polyfill using WebGPU compute shaders. If a web developer wants to use a cloud model, with the associated legal requirements and business relationships of that model, we already have a way to do that: Use Fetch API on a CORS endpoint. There's no need to have the browser do cloud model brokering to a model you haven't tested with, run by a company you might not want to actually do business with.
• Tepix 5mo ago
  I feel that a LLM that runs locally has its place in a modern browser. The alternative is sending your page contents to a server in the cloud with the associated loss of privacy. Of course issues like fingerprintability and vendor model lockin have to be taken into account. It seems to be too early to carve things in stone, so I agree with Brian Grinstead and the others.
  • wavemode 5mo ago
    The alternative is that web pages just don't run inference? Why is that something a web page should expect to have a right to? If you want to burn a bunch of GPU heat, spend it on your own servers, not my computer. Either way, if this does happen I definitely hope it gets put behind a brower permission.
    • Tepix 5mo ago
      It already is, the first time you use it you have to download the weights and you can just abort at that point.
• dbetteridge 5mo ago
  To paraphrase Mean Girls Stop trying to make browser llms happen, they're not going to happen.
• isodev 5mo ago
  Google on their proposal: > Browsers and operating systems are increasingly expected to gain access to language models. I think this is only true amongst “AI all the things” folks. Both tech and non-tech people around me are more focused on turning these features off. Some even avoid sensitive actions like banking from LLM infused browsers. So I think Mozilla is right to object. This API is not in the interest of the user/agent.
• herf 5mo ago
  Chrome seems to use a custom inference runtime also (in addition to Gemini Nano). It would be better if this were all interoperable. The WebGPU alternatives like WebLLM do not have the same access. I've been trying these models out for the last year, and it seems to me that we want them to work in a 5-10W "laptop" power envelope, but they really work best with a 50-500W GPU instead - i.e. they eat batteries. This means things work better in a "plugged in" gaming laptop/desktop rather than a typical web client. At least for now.
• rhdunn 5mo ago
  What's the usecase for this API? My experience with running LLMs locally is spinnnig up llama-server (possibly on a separate machine) and then configuring other applications to point to that OpenAI compatible web server instead of OpenAI or similar. I don't want a web browser creating/running an LLM instance as that machine may not have the capability or capacity to run an LLM instance.
• fork-daemon 5mo ago
  [flagged]
• cosmic_cheese 5mo ago
  Why is it that Google is fixated on bolting on ever more junk and turning browsers into Homermobiles[0] instead of putting those vast resources towards fixing the numerous structural weaknesses in everything that browsers are already capable of? Why not focus on foundational things that will improve quality of life for everything on the web platform ranging from static blogs to e-commerce to cutting edge web apps? Really, I just can’t understand it. [0]: https://simpsons.fandom.com/wiki/The_Homer https://simpsons.fandom.com/wiki/The_Homer
  • bloppe 5mo ago
    If you want to go for promo at Google, you gotta launch a prompt API
  • zamadatix 5mo ago
    Google doesn't build Chrome to make a better web. Building a good browser for the sake of building a good browser is throwing billions towards goodwill while Google's goal with Chrome is to further replace the user's OS as the platform users do things on their devices with. Google has Android & ChromeOS to directly try to do that but Chrome makes it so the average user using e.g. Windows still ends up in a Google world most of the time.
    • deleted 5mo ago
      [deleted]
  • lxgr 5mo ago
    How would not implementing a prompt API make them dedicate their resources to something else they didn't consider important before? This seems like a false dichotomy.
  • afavour 5mo ago
    Chrome is an operating system for Google. It gives them a way into corporate environments that run Windows far more easily than getting those companies to convert to ChromeOS or something. So they keep adding features because they want users to be able to do just about anything in there.
• franze 5mo ago
  [dead]
• saltyoldman 5mo ago
  I'll continue to make calls to my models via API calls. lol
• notnullorvoid 5mo ago
  I strongly believe LLMs and API harnesses of today simply are not at the technological stage where such an API makes sense in standards. However if this needs to be done, then it needs to be a opt-in per site permission at the very least, and there should be a way to verify the identity of which model is being prompted (which extends to even minor tweaks made to system prompts). As a user I need to be sure that I can't be fingerprinted by navigating to a random site and them using this API without my permission. As a dev I need to know what model my users are using, so I have the option to craft specific prompts per model.