Meta warns Ray-Ban Display developers that untrusted-content flag is not an enforced security boundary

Meta’s documentation for WebMCP on Ray-Ban Display states that the `untrustedContentHint` flag is not an enforced security boundary, advising developers to validate all inputs and never accept the assistant’s account of actions without verification. The guidance, published ahead of a wide release, notes that WebMCP is currently off by default and enabled per device via Developer Mode or rollout. It highlights silent failures when using seven reserved tool names like `openUrl` and `goBack`. These instructions apply to glasses priced at £749 in the UK and €899 in Germany, emphasizing that text handed to the model may carry injection risks.