WebAssembly EU

Webassembly community hosting the W3C CG Discord and Munich Meetup run by @ttraenkler

[felix ringe @felixringe]

We have discovered a substantial number of vulnerabilities in the German legal system using LLMs.

These may enable access to confidential documents, travel without an otherwise required visa, enforceable leave for soldiers at NATO’s JSEC, and more.

Similar to computer systems, the written law can contain vulnerabilities that invite exploitation. In our blog post, we share a selection of vulnerabilities, and present potential exploits for each. To our knowledge, none of these have been previously recorded. We share only those vulnerabilities whose exploitation we believe would not cause serious harm.

blog post: https://t.co/hsYTiJpNoJ

[Wasmer @wasmerio]

🤯 WHOA...
Someone rebuilt Photoshop in pure Rust.

Layers, masks, adjustment layers, type, vectors, brushes ...and runs in your browser via WebAssembly.

Open source. No Adobe subscription needed.

Try it online 👉 https://t.co/dMQeIo09sP

[WebAssembly EU @WebAssemblyEU]

@zack_overflow Much like LLVM isn’t a virtual machine, it is a term to explain something very abstract in terms people could relate

[Wasm3 @wasm3_engine]

❯❯❯❯ Expect in #Wasm3 v0.9.1
• Multiple Memories
• Memory64 + Tables64
• Improved Module Linking

#WebAssembly

[JS² 🐇 @js2compiler]

First level complete:
ECMAScript 5 100%

#js #javascript #wasm #webassembly

[Wasm3 @wasm3_engine]

⚠️Recently, several #WebAssembly interpreters have appeared with "faster than Wasm3" claims.

Obviously - more compact, embeddable interpreters pushing performance forward is healthy for the whole software ecosystem.
1/7

[Alvin Lau @aellfiyn]

https://t.co/K7q3uTeFbN

[athas.dev @athasdev]

You can use Ghostty’s WebAssembly terminal engine on Athas now, instead of xterm.js.

[Wasm3 @wasm3_engine]

Wasm3 v0.9.0 is out!

[ayush🔮👨‍💻🔮 @ayushagarwal027]

Cloudflare built a browser. It runs entirely inside V8 isolates on Workers, largely in Rust. 🦀

Meet Kitesurf : a new browser engine built specifically for AI agents, not humans. The insight driving it: Chromium was built for tabs, extensions, and 60fps scrolling. Agents care about token count, cost, and scalability. Different job, different tool.

The Rust side does the heavy lifting:
→ Blitz (HTML/layout) and Stylo (Firefox's own CSS parser) : both Rust, compiled straight to WebAssembly via wasm-bindgen, no Emscripten overhead

→ Boa JS : a Rust-based ECMAScript engine, used to handle eval() safely inside the sandbox

→ Every component isolated by design : untrusted page content never touches more than it strictly needs

The results, benchmarked against Chromium on real workloads:
→ 3-7x less memory and CPU for screenshots and HTML extraction
�� 215,000+ Web Platform Tests passing, growing every week
→ Chromium still wins on raw wall-clock speed (~1.7x, thanks to its warmed-up JIT) they're upfront about that tradeoff

And yes, it runs Doom.

Still early : no WebGL, no video, no bot-detection bypass yet, but a genuinely serious infrastructure bet on Rust and Wasm, at real production scale. Open source release planned soon.

🔗 https://t.co/ue8ji8CiQc

#RustLang #WebAssembly #Cloudflare #AI

[SuperVictor64 @SuperVictor64]

Seeing 2016 Roblox studio ported to a web browser (With WebAssembly) is absolutely crazy!

[JS² 🐇 @js2compiler]

eval support is in ��� both for strings known at compile time (AOT compiled) and unknown at compile time (optional interpreter side module). passing 96% of eval tests in test262.

#javascript #js #webassembly #wasm #ecmascript

[JS² 🐇 @js2compiler]

JavaScript ahead-of-time compiler js2asm now passes 88.8% of official ECMAScript 5 test suite.

https://t.co/GrsFfg8SZN
#javascript #webassembly #js #wasm

[窓の杜 @madonomori]

「Chrome」で「Firefox」が動く……!?　WebAssemblyで実装された「Gecko」エンジン／意味があるかどうかはともかくロマンたっぷり【やじうまの杜】 https://t.co/mKsVctRE8X

[Visual Studio Code @code]

You may have noticed that search on the @code website has gotten a lot quicker lately.

In our latest blogpost, @joaomoreno breaks down the engineering process behind docfind, a search engine we built that runs entirely in your browser using WebAssembly: https://t.co/QRw2S7NBMr

[Three.js @threejs]

The future of Three.js is WebAssembly

[Ashley Peacock @ashleypeacock]

Cloudflare built a browser that runs INSIDE a Cloudflare Worker 🤯

Cloudflare Agents Week day 4 is here, and it's a banger:

🪁 Kitesurf: agent-first browser running on Workers
🕸️ WebMCP: Give any website an MCP interface
⚒️ The next generation of MCP is here
🔍 AI Search improvements + pricing announced
🤖 AI Readiness in the Dash & AEO diagnosis
🌎 Building an open Agentic Internet

🪁 Kitesurf: agent-first browser running on Workers 🪁

There are projects that come up from time to time that are uniquely Cloudflare, and Kitesurf is one of them. Workers are an insanely powerful primitive, and there is very little they can't do these days.

Kitesurf is a browser built for the agentic web. Chromium-backed browsers are large, and use a lot of memory. There simply isn't enough memory for every agent in the world to have a browser. That's where Kitesurf comes in, a lightweight alternative to Chromium-based browsers.

It uses WebAssembly, Dynamic Workers, Durable Objects and more to make this happen. And yes, it can run Doom.

Best of all, it's available in open beta to try today for free, via Browser Rendering's CDP endpoint and Quick Actions.

If you want to see it in action, there's a public playground too, linked below, as well as the full blog post - which is packed with interesting technical details!

🕸️ WebMCP: Give any website an MCP interface 🕸️

WebMCP is a new browser standard that lets any website expose itself via MCP. Rather than an agent having to click around the website, it can interact with it using MCP instead.

You could implement this yourself, but why would you, when Cloudflare can enable it on your site with one toggle?

You can enable this in the dashboard today under Agent Readiness > Labs. There's currently two groups of featuers you can enable, called packs, to help agents browser your website.

⚒️ The next generation of MCP is here ⚒️

The Model Context Protocol (MCP) has evolved over time, and the latest iteration makes it simpler than ever. How? By making it so that an MCP server can be stateless. That removes the burden of sticky sessions and other complexities from running an MCP server.

With the rapid movement of the AI landscape, it's important for companies to move in the direction the puck is going. Once again, Cloudflare is ready to receive the puck, as stateless MCP servers have been possible on Cloudflare for some time.

That means, from day one of the specification being announced, it has been supported on Cloudflare when using the official MCP SDKs.

There's a bunch of other changes as part of this spec, including:

- Elicitation no longer needs an open stream
- Mcp-Method and Mcp-Name in HTTP headers, to avoid parsing request bodies for features such as rate limiting
- MCP now prefers pre-registered clients when the server and client already have a relationship, then Client ID Metadata Documents (CIMD) for dynamic registrations, with Dynamic Client Registration (DCR) as a fallback

And much more. This is a good one to read yourself, as there's a lot of technical depth to the article!

🔍 AI Search Improvements 🔍

AI Search is Cloudflare's offering to solve the problem of how you give your AI agent access to specific knowledge to improve its work. In simple terms, it makes the RAG aspect of your AI agents effortless.

AI Search already lets you ingest data into an R2 bucket, scrape your own website, along with an array of options at search time.

AI search can now:

- You no longer need a sitemap to ingest your website's data, Cloudflare will discover the pages automatically
- Get a single public endpoint for searching across a namespace (both /search and /mcp).
- Add a custom domain to your public AI search namespaces
- Add semantic search to your sites built on EmDash (Cloudflare's WordPress successor) with AI Search plugin

AI Search always identifies itself when crawling websites, and respects bot protections that website owners put in place.

Pricing is also being announced today, as AI Search has been in beta since its release. As always, there's a generous free plan too, with full details in the blog post.

🤖 AI Readiness in the Dash & AEO diagnosis Share of Voice

Getting your website ready for the agentic era is no small feat. There's a ton of protocols, and a bunch of considerations around how to make your website accessible to AI agents.

In April, Cloudflare launched a tool to check your website's readiness for AI agents. That tool is now available in the dashboard for all your websites hosted on Cloudflare.

Alongside the check, the tool provides actionable insights on how to improve your website's agent readiness.

Now, if you thought getting your website ready for agents was some dark art, then AEO takes that to another level.

AEO is the practise of getting your website content surfaced in public LLMs such as ChatGPT and Gemini.

Working out if your website is AEO optimised is incredibly hard. That's why Cloudflare is launching a new tool today that allows you to get insights into how your website performs on the AEO front, with insights such as:

- Citation Rate
- Prominence
- Mention Rate
- Share of Voice

Putting your website behind Cloudflare has always been a no-brainer, but it's rapidly becoming a deal breaker with the new tools available to websites hosted on Cloudflare, such as the new AEO tool.

🌎 Building an open Agentic Internet 🌎

AI agents are a new kind of web user, they are already overtaking humans in terms of request volume.

Every request has a paying human behind it, so if you treat agents the same way you do web scrapers, you're potentially blocking paying customers.

That's why Cloudflare is working hard to set the standards to make the web ready for the agentic era. These are based on open standards such as x402, MCP, Web Bot Auth and PACT.

There's four pillars that Cloudflare believes paves the way for an Agentic web:

- Readable, so agents can read content cheaply via Markdown (and Kitesurf, a lightweight agent-first browser!)
- Discoverable, meaning agents can find things through AI Search, and sites measure their agent visibility with AEO
- Callable, with sites exposing actions directly to agents via WebMCP and Code Mode
- Payable, with agents paying per use with Wallets and x402. Monetization Gateway lets sites charge agents in a few clicks, replacing broken ad models of what came before.

Ultimately, Cloudflare's mission is to help build a better Internet. Today, it is reaffirming that aim in the era of the agentic web, with the aim to enable AI agents and website owners to thrive on the agentic internet.

If you made it this far, thank you for reading - it was a pretty chonky one today, and there's one more day of announcements tomorrow! What did you think of today's announcements?

[Firefox for Web Developers @FirefoxWebDevs]

JS promise integration for WebAssembly landed in Firefox 153, making it easier to work with asynchronous calls from Wasm. Here's how it works:

[Peter Steinberger @steipete]

OpenClaw's dependency purge continues. Killed Sharp and Jimp. Replaced it with photon, a small WebAssembly that runs compiled Rust for image processing. 2MB vs 140MB. https://t.co/tSimX2GKwP

[Andrew @android_stern]

You can try my synth in your phone's browser.

https://t.co/EmeOIA5Upw

Cosimo (real name tbd) is a full wavetable synth with msegs, warp-modes, and fx compiled to webassembly and running wherever you have a web browser, including your iphone.

You can just put serum on the internet, it turns out.